CVE-2026-110524

Description

The Copy Anything to Clipboard for WordPress WordPress plugin before 5.5.5 does not sanitize and escape a shortcode attribute before storing it and writing it back into the page through a client-side script, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who view and interact with the content.

References

https://wpscan.com/vulnerability/4ee29b7c-ae80-4875-bd78-7128ff4e5e1c/

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-111713

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3