CVE-2025-11504

Name of the Vulnerable Software and Affected Versions Quickcreator – AI Blog Writer plugin for WordPress versions 0.0.9 through 0.1.17

Description The Quickcreator – AI Blog Writer plugin for WordPress is susceptible to exposure of sensitive information. An unauthenticated attacker can access the plugin’s API key through the /wp-content/plugins/quickcreator/dupasrala.txt file. Successful retrieval of the API key allows an attacker to perform actions on the site, including creating new posts and injecting cross-site scripting (XSS) payloads.

Recommendations Update the Quickcreator – AI Blog Writer plugin to a version later than 0.1.17.