PT-2026-145710

CVE-2026-123044

Published

2026-11-12

Updated

2026-11-12

Description by

CVSS 3.1

7.5

High

MetricsAV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

The ContentPen WordPress plugin before 1.1.1 discloses its REST API key to unauthenticated users, who can then use it to create posts containing unfiltered JavaScript, leading to Stored XSS that executes in the browser of any visitor, including administrators.

Exploitability

Exploit

Fix

Impacts

Researchers

Claudio Marchesini

Dottor Marc

Enrico Marcolini

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')