CVE-2026-9269 is a stored cross-site scripting vulnerability in the Secure Copy Content Protection and Content Locking WordPress plugin prior to version 5.1.5. The plugin fails to sanitize and escape certain settings, enabling high privilege users like admins to inject malicious scripts that persist in the plugin's stored data. This can occur even when the unfiltered_html capability is disallowed, such as in multisite environments, potentially leading to stored XSS attacks.

An attacker with high privileges (e.g., an administrator) can exploit this vulnerability to inject and store malicious scripts within plugin settings. These scripts could execute in the context of other users viewing the affected content, potentially leading to session hijacking, privilege escalation, or other malicious actions. However, exploitation requires high privilege access, limiting the attack surface to trusted users.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted users only and monitor plugin updates for a security patch addressing this issue.