CVE-2026-1320 is a stored cross-site scripting vulnerability in the Secure Copy Content Protection and Content Locking plugin for WordPress. It occurs due to improper neutralization of input from the 'X-Forwarded-For' HTTP header, which is not adequately sanitized or escaped before being included in web pages. This flaw allows unauthenticated attackers to inject arbitrary web scripts that execute in the context of users visiting the compromised pages. The vulnerability affects all versions up to and including 4.9.8 and has a CVSS 3.1 base score of 7.2, indicating high severity. There is no information about an available patch or vendor advisory at this time.

Successful exploitation enables an unauthenticated attacker to perform stored cross-site scripting attacks, potentially leading to the execution of arbitrary scripts in users' browsers. This can result in information disclosure or manipulation of user sessions. The vulnerability does not impact availability and requires no privileges or user interaction to exploit.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing web application firewall (WAF) rules to detect and block malicious payloads in the 'X-Forwarded-For' header. Monitor plugin updates from the vendor and apply official patches promptly once released.