CVE-2025-1404: 
WordPress vulnerability analysis and mitigation

The Secure Copy Content Protection and Content Locking WordPress plugin version 4.2.3 and earlier contains a Reflected Cross-Site Scripting vulnerability. This vulnerability was discovered by researcher Krzysztof Zając and disclosed on February 28, 2025, with a CVSS score of 6.1 (Wordfence Intel).

The vulnerability is classified as a Reflected Cross-Site Scripting (XSS) issue with a CVSS v3.1 base score of 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N). This indicates that the vulnerability has network access vector, low attack complexity, requires no privileges, and can result in low confidentiality impact (Wordfence Intel).

The vulnerability could allow attackers to execute malicious scripts in users' browsers, potentially leading to theft of sensitive information or manipulation of website content. The impact is primarily focused on confidentiality with no direct effect on integrity or availability of the system (Wordfence Intel).

The vulnerability was addressed in version 4.2.4 of the plugin. Users are advised to update to the latest version to protect against this security issue. The fix was implemented as part of the regular security maintenance of the plugin (WordPress Plugin).