An unauthenticated Stored Cross-Site Scripting vulnerability in the Secure Copy Content Protection and Content Locking plugin allows remote attackers to inject malicious scripts into WordPress pages.

The plugin fails to properly sanitize the X-Forwarded-For HTTP header before storing it, allowing unauthenticated attackers to inject arbitrary web scripts that execute within the context of a victim's session.

Successful exploitation of this vulnerability can lead to unauthorized script execution in the browsers of site administrators or visitors. This facilitates session hijacking, the theft of sensitive session cookies, or the defacement of the affected website. Given the CVSS score of 7.2, this vulnerability represents a high risk to organizational data integrity and user security.

Immediate Action: Update the Secure Copy Content Protection and Content Locking plugin to the latest patched version available in the WordPress repository.

Proactive Monitoring: Review web server access logs for anomalous X-Forwarded-For header values containing script tags or suspicious JavaScript patterns.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to inspect and sanitize HTTP headers, specifically blocking requests containing script injection payloads in the X-Forwarded-For field.

Public Exploit Available: Unknown.

This vulnerability presents a significant risk because it allows unauthenticated remote code injection. Administrators should verify their current plugin version immediately and apply the vendor patch. If an update is not immediately feasible, consider temporarily deactivating the plugin to prevent potential exploitation of the stored XSS vector.