{"schema":"threatline.record/2","record":{"id":"CVE-2026-110524","aliases":[],"summary":"Copy Anything to Clipboard < 5.5.5 - Contributor+ Stored XSS via 'success-text' Shortcode Attribute","details":"The Copy Anything to Clipboard for WordPress  WordPress plugin before 5.5.5 does not sanitize and escape a shortcode attribute before storing it and writing it back into the page through a client-side script, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks against higher-privileged users who view and interact with the content.","categories":["Applications & CMS"],"product":"Copy Anything to Clipboard for WordPress","vendor":"Unknown","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110524","source_modified_at":"2026-10-28T06:00:23.783Z","fetched_at":"2026-10-28T08:18:35.509402Z","product":"Copy Anything to Clipboard for WordPress","vendor":"Unknown","versions":[{"status":"affected","versionType":"semver","version":"0","lessThan":"5.5.5"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-110524","source_modified_at":"2026-10-28T06:00:23.783Z","fetched_at":"2026-10-28T08:18:35.509402Z","package":{"name":"Copy Anything to Clipboard for WordPress","ecosystem":null},"version":"5.5.5","basis":"first unaffected version stated in the CVE record"}],"cvss":null,"severity":null,"kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T06:00:23.783Z","modified_at":"2026-10-28T06:00:23.783Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-110524","fetched_at":"2026-10-28T08:18:35.509402Z","source_modified_at":"2026-10-28T06:00:23.783Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://wpscan.com/vulnerability/4ee29b7c-ae80-4875-bd78-7128ff4e5e1c/","tags":["exploit","vdb-entry","technical-description"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"product","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-28T06:00:23.783Z","content_hash":"e7ee4ba0c40be48a6e0730d3ab99db1baa1923b689760047630c978d05dfa4d8"}}