Vulnerability record/PUBLISHED/Published Nov 12, 2026 06:00:08 UTC
CVE-2026-123044
The ContentPen WordPress plugin before 1.1.1 discloses its REST API key to unauthenticated users, who can then use it to create posts containing unfiltered JavaScript, leading to Stored XSS that executes in the browser of any visitor, including administrators.
Base score7.5/ 10
SeverityHighCVSS 3.1
Exploitability / impact
CVSS metric breakdown
Base severityHigh
Attack vectorNetworkAV
Attack complexityHighAC
Privileges requiredNonePR
User interactionRequiredUI
ScopeUnchangedS
Confidentiality impactHighC
Integrity impactHighI
Availability impactHighA
CVSS vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HCVSS communicates standardized severity and impact characteristics. It does not establish whether a system is exploitable in your specific environment.
Record context
CVE Numbering AuthorityWPScan
Last updatedNov 12, 2026 11:22:49 UTC
PublishedNov 12, 2026 06:00:08 UTC
ReservedNov 5, 2026 08:34:47 UTC
Credits
- Enrico Marcolini
- Claudio Marchesini
- Dottor Marc
- WPScan