CVE-2026-9269

Name of the Vulnerable Software and Affected Versions Secure Copy Content Protection and Content Locking versions prior to 5.1.5

Description The plugin fails to sanitize and escape certain settings, enabling high-privilege users, such as administrators, to execute Stored Cross-Site Scripting attacks. This occurs even in environments where the unfiltered html capability is disabled, such as multisite setups. The issue is specifically linked to the ays sccp sub icon image parameter.

Recommendations Update to version 5.1.5 or later.