CVE-2026-123044 PUBLISHED

ContentPen < 1.1.1 - Unauthenticated Stored XSS via API Key Disclosure

Assigner: WPScan
Reserved: 05.11.2026 Published: 12.11.2026 Updated: 12.11.2026

The ContentPen WordPress plugin before 1.1.1 discloses its REST API key to unauthenticated users, who can then use it to create posts containing unfiltered JavaScript, leading to Stored XSS that executes in the browser of any visitor, including administrators.

Product Status

Vendor Unknown
Product ContentPen
Versions Default: unaffected
  • affected from 0 to 1.1.1 (excl.)

Credits

  • Enrico Marcolini finder
  • Claudio Marchesini finder
  • Dottor Marc finder
  • WPScan coordinator

References

Problem Types

  • CWE-79 Cross-Site Scripting (XSS) CWE