{"id":"CVE-2026-110524","kind":"vulnerability","aliases":["CVE-2026-110524"],"related":[],"title":"WordPress Copy Anything to Clipboard plugin: shortcode stored XSS for contributors","description":"The Copy Anything to Clipboard for WordPress  WordPress plugin before 5.5.5 does not sanitize and escape a shortcode attribute before storing it and writing it back into the page through a client-side script, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who view and interact with the content.","summary":"The Copy Anything to Clipboard plugin for WordPress stores an unsanitized shortcode attribute and writes it back into pages through client-side script. A contributor-role user can inject script that runs in the browser of higher-privileged users who view the content.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["no-contributor-accounts","plugin-5.5.5-or-later","plugin-not-installed"],"how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get copy-anything-to-clipboard --field=version` if WP-CLI is available\n- Search post content for the plugin's shortcode to find where it is used","fix":"- Update the Copy Anything to Clipboard for WordPress plugin to `5.5.5` or later\n- Review existing content created by contributors for suspicious script inside shortcode attributes","status":"open","published_at":"2026-10-28T06:16:33+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","triaged_at":"2026-10-28T06:32:41+00:00","updated_at":"2026-10-28T06:32:41+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T06:32:41Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Copy Anything to Clipboard for WordPress plugin to `5.5.5` or later\n- Review existing content created by contributors for suspicious script inside shortcode attributes","reach":"internet","title":"WordPress Copy Anything to Clipboard plugin: shortcode stored XSS for contributors","impact":"medium","summary":"The Copy Anything to Clipboard plugin for WordPress stores an unsanitized shortcode attribute and writes it back into pages through client-side script. A contributor-role user can inject script that runs in the browser of higher-privileged users who view the content.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker script runs in privileged users' browsers, enabling session or admin actions.","analyst_note":"","how_to_check":"- Check the installed plugin version in the WordPress admin under Plugins, or with `wp plugin get copy-anything-to-clipboard --field=version` if WP-CLI is available\n- Search post content for the plugin's shortcode to find where it is used","needs_analyst":false,"not_affected_if":["plugin-not-installed","no-contributor-accounts","plugin-5.5.5-or-later"],"who_is_affected":"Sites running the Copy Anything to Clipboard for WordPress plugin before 5.5.5 that let contributor-level or higher users write content using its shortcode. Sites with no contributor accounts, or where the plugin is not installed, can skip it.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000622,"input_tokens":3339,"output_tokens":577,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-110524':14A,17A '-2026':13A,16A '5.5.5':82C 'allow':109C 'anyth':3A,28B,74C 'attack':124C 'attribut':38B,90C 'back':42B,97C 'browser':62B 'client':47B,104C 'client-sid':46B,103C 'clipboard':5A,30B,76C 'content':71B,136C 'contributor':11A,52B,113C 'contributor-rol':51B 'copi':2A,27B,73C 'could':108C 'cross':121C 'cross-sit':120C 'cve':12A,15A 'escap':87C 'higher':65B,127C 'higher-privileg':64B,126C 'host':21B 'inject':56B 'interact':133C 'packag':18B 'page':44B,100C 'perform':118C 'plugin':6A,25B,31B,80C 'privileg':66B,128C 'role':53B,114C 'run':59B 'sanit':85C 'script':49B,57B,106C,123C 'self':20B 'self-host':19B 'shortcod':7A,37B,89C 'side':48B,105C 'site':122C 'store':8A,34B,92C,119C 'unsanit':36B 'user':54B,67B,110C,129C 'view':69B,131C 'wordpress':1A,22B,24B,33B,78C,79C 'wordpress-plugin':23B 'write':40B,95C 'xss':9A","nicknames":[],"mitigations":[],"who_affected":"Sites running the Copy Anything to Clipboard for WordPress plugin before 5.5.5 that let contributor-level or higher users write content using its shortcode. Sites with no contributor accounts, or where the plugin is not installed, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T06:16:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-110524","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-110524","severity":null,"published_at":"2026-10-28T06:16:33+00:00","modified_at":"2026-10-28T06:16:33+00:00","first_seen_at":"2026-10-28T06:31:27+00:00","fetched_at":"2026-10-28T06:31:27+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}