Stored Cross-Site Scripting in Copy Anything to Clipboard for WordPress by WPML
CVE-2026-110524
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 28 October 2026
Badges
What is CVE-2026-110524?
The Copy Anything to Clipboard for WordPress plugin prior to version 5.5.5 has a vulnerability that allows shortcodes to be stored and written back to web pages without adequate sanitization and escaping. This oversight can enable users with contributor roles and above to execute Stored Cross-Site Scripting attacks, targeting higher-privileged users who interact with the affected content. The lack of proper validation can lead to unauthorized scripts running in the context of an authenticated user’s session, potentially compromising their account and data.
Affected Version(s)
Copy Anything to Clipboard for WordPress 0 < 5.5.5
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.