CVE-2026-88903

Name of the Vulnerable Software and Affected Versions Topcontent versions prior to 1.2.2

Description An issue exists where a request handler is not properly authorized and HTML sanitization is disabled before storing submitted content. This allows unauthenticated attackers to publish arbitrary posts containing malicious JavaScript on sites where the API key has not been configured. This leads to Stored Cross-Site Scripting (XSS), a condition where malicious scripts are permanently stored on the target server.

Recommendations Update Topcontent to version 1.2.2 or later.