Stored XSS in Copy Anything to Clipboard via success-text shortcode
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-79.
Summary
The Copy Anything to Clipboard WordPress plugin before 5.5.5 does not sanitize or escape a shortcode attribute before storing it and writing it back into the page through a client-side script. This is cross-site scripting (CWE-79). An attacker with the contributor role or higher can perform stored cross-site scripting against higher-privileged users who view and interact with the content, and user interaction is required. The references link an exploit.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the CNA
The Copy Anything to Clipboard for WordPress WordPress plugin before 5.5.5 does not sanitize and escape a shortcode attribute before storing it and writing it back into the page through a client-side script, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who view and interact with the content.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Unknown | Copy Anything to Clipboard for WordPress | before 5.5.5 | 5.5.5 | Patch available | CNA |
- Copy Anything to Clipboard for WordPress VendorUnknown Affected before 5.5.5 Fixed in 5.5.5 Patch available CNA
Remediation
Update Copy Anything to Clipboard for WordPress to version 5.5.5 or later.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · CNA Copy Anything to Clipboard for WordPress (Unknown) Fixed in 5.5.5
Timeline
- 2026-10-28 Threatist record created from CVE-2026-110524
- 2026-10-28 Alias added: GHSA-m4h7-mwp4-h59c
- 2026-10-28 CVSS score added · CISA ADP
- 2026-10-28 Weakness changed · CISA ADP
- 2026-10-28 CISA SSVC decision points changed
References
Sources
- CVE-2026-110524 · CVE Program
- CVE-2026-110524 · NVD
- FIRST EPSS
- GHSA-m4h7-mwp4-h59c · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences