CVE-2026-2367 is a stored cross-site scripting vulnerability in the Secure Copy Content Protection and Content Locking WordPress plugin (versions up to 5.0.1). The flaw exists due to improper neutralization of input in the 'ays_block' shortcode, where user-supplied attributes are not adequately sanitized or escaped before output. Authenticated attackers with contributor-level permissions or higher can exploit this to inject arbitrary JavaScript that executes in the context of users visiting the compromised pages. The vulnerability does not require user interaction beyond page access and affects confidentiality and integrity but not availability.

Successful exploitation allows an authenticated contributor or higher to inject persistent malicious scripts into pages, which execute in the browsers of users viewing those pages. This can lead to theft of user credentials, session hijacking, or other malicious actions within the context of the affected site. The CVSS score of 6.4 reflects a medium impact on confidentiality and integrity with no impact on availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the plugin if possible. Monitor for plugin updates that address this vulnerability and apply them promptly once released.