Is CVE-2026-9269 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-9269 being exploited in the wild.

How severe is CVE-2026-9269?

Informational severity, with a CVSS score of 3.5, published 12 June 2026.

Is there a fix for CVE-2026-9269?

A patch was published on 2026-05-22: Fixed version 5.1.5 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-9269 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-9269?

Check whether you run AYS Pro Secure Copy Content Protection and Content Locking at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-9269: Secure Copy Content Protection and Content Locking Stored XSS in settings

CVE-2026-9269 · Severity: info · CVSS 3.5 · Published 2026-06-12

The Secure Copy Content Protection and Content Locking plugin for WordPress, which is used to prevent unauthorized copying of website content, contains a security flaw. This vulnerability allows high-privileged users, such as site administrators, to inject malicious scripts into the website's settings. This is particularly significant in multi-site environments where even administrators are normally restricted from adding custom scripts to prevent them from compromising the entire network or other users' sessions.

Vendors: AYS Pro.

Quick answers

Is CVE-2026-9269 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-9269 being exploited in the wild.
How severe is CVE-2026-9269?: Informational severity, with a CVSS score of 3.5, published 12 June 2026.
Which products and versions are affected?: AYS Pro Secure Copy Content Protection and Content Locking < 5.1.5.
Is there a fix for CVE-2026-9269?: A patch was published on 2026-05-22: Fixed version 5.1.5 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-9269 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-9269?: Check whether you run AYS Pro Secure Copy Content Protection and Content Locking at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The Secure Copy Content Protection and Content Locking plugin for WordPress fails to properly sanitize and escape the 'ays_sccp_sub_icon_image' parameter within its settings page. This oversight results in a Stored Cross-Site Scripting (XSS) vulnerability. An authenticated attacker with high privileges (such as an administrator) can inject malicious JavaScript into the plugin settings. This script will then execute in the browser of any user who visits the affected settings page. This bypasses 'unfiltered_html' restrictions typically enforced in WordPress Multisite configurations. The issue is fixed in version 5.1.5.

Affected products

ays-pro Secure Copy Content Protection and Content Locking < 5.1.5

Timeline

2026-05-22: disclosed: Publicly published by WPScan
2026-06-12: advisory: NVD publication date
2026-05-22: patched: Fixed version 5.1.5 released

References

https://wpscan.com/vulnerability/61a3f41d-f031-4dba-b5cf-4ca3bce71b1b/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.