Live › vulnerability › CVE-2026-110524
Go to dashboardThe Copy Anything to Clipboard plugin for WordPress stores an unsanitized shortcode attribute and writes it back into pages through client-side script. A contributor-role user can inject script that runs in the browser of higher-privileged users who view the content.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Sites running the Copy Anything to Clipboard for WordPress plugin before 5.5.5 that let contributor-level or higher users write content using its shortcode. Sites with no contributor accounts, or where the plugin is not installed, can skip it.
No product ranges from the sources yet.
wp plugin get copy-anything-to-clipboard --field=version if WP-CLI is available5.5.5 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Copy Anything to Clipboard for WordPress WordPress plugin before 5.5.5 does not sanitize and escape a shortcode attribute before storing it and writing it back into the page through a client-side script, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who view and interact with the content.
This page as .md · .json · in your agent: get_signal("CVE-2026-110524")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.