Skip to content
Noroxi

Secure Copy Content Protection and Content Locking

secure-copy-content-protection · plugin

Known security vulnerabilities for Secure Copy Content Protection and Content Locking. Find out in seconds which version runs on your site with WP Lens.

10 known vulnerabilities

6 exploitable without logging in · latest Feb 25, 2026

Listed on wordpress.org · latest 5.2.9 · last updated Sep 29, 2026 · 20K+ installs

wordpress.org status checked on Oct 2, 2026

Vulnerabilities

  • CVE-2026-1320unauthenticated≤ 4.9.8

    Secure Copy Content Protection and Content Locking <= 4.9.8 - Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header

    High 7.2

  • CVE-2025-30905unauthenticated · needs a click≤ 4.4.3

    WordPress Secure Copy Content Protection and Content Locking plugin <= 4.4.3 - Cross Site Scripting (XSS) vulnerability

    High 7.1

  • CVE-2026-2367contributor+≤ 5.0.1

    Secure Copy Content Protection and Content Locking <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute

    Medium 6.4

  • CVE-2025-32133high privilege≤ 4.5.5

    WordPress Secure Copy Content Protection and Content Locking plugin <= 4.5.5 - Cross Site Scripting (XSS) vulnerability

    Medium 5.9

  • CVE-2025-14442unauthenticated≤ 4.9.2

    Secure Copy Content Protection and Content Locking <= 4.9.2 - Unauthenticated Sensitive Information Exposure via Exposed CSV Export File

    Medium 5.3

  • CVE-2025-1404unauthenticated≤ 4.4.7

    Secure Copy Content Protection and Content Locking <= 4.4.7 - Missing Authorization to Unauthenticated User Email Retrieval via ays_sccp_reports_user_search Fun

    Medium 5.3

  • CVE-2024-33587unauthenticated≤ 3.9.0

    WordPress Secure Copy Content Protection and Content Locking plugin <= 3.9.0 - Broken Access Control vulnerability

    Medium 5.3

  • CVE-2025-14159unauthenticated · needs a click≤ 4.9.2

    Secure Copy Content Protection and Content Locking <= 4.9.2 - Cross-Site Request Forgery to Data Export

    Medium 4.3

  • CVE-2026-25335login required≤ 5.0.0

    WordPress Secure Copy Content Protection and Content Locking plugin <= 5.0.0 - Broken Access Control vulnerability

    Medium 4.3

  • CVE-2024-32787login required≤ 3.7.1

    WordPress Secure Copy Content Protection and Content Locking plugin <= 3.7.1 - Broken Access Control vulnerability

    Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory