CVE-2026-123044
HIGH
MEDIUM
Priority: 0.01
BB Relevance:
55/100
Published: 2026-11-12
Modified: 2026-11-12
First seen: 2026-11-12
Status: active
Attack Surface
Network
No Auth
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
None
UI:
Required
S:
Unchanged
C:
High
I:
High
A:
High
Description
The ContentPen WordPress plugin before 1.1.1 discloses its REST API key to unauthenticated users, who can then use it to create posts containing unfiltered JavaScript, leading to Stored XSS that executes in the browser of any visitor, including administrators.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| Unknown | ContentPen | 0 < 1.1.1 |
| Unknown | ContentPen | 0 < 1.1.1 |