CVE-2026-123044
ContentPen < 1.1.1 - Unauthenticated Stored XSS via API Key Disclosure
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The ContentPen WordPress plugin before 1.1.1 discloses its REST API key to unauthenticated users, who can then use it to create posts containing unfiltered JavaScript, leading to Stored XSS that executes in the browser of any visitor, including administrators.
| Vendor | unknown |
| Product | contentpen |
| Published | Nov 12, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown contentpen
Be the first to know when new unknown vulnerabilities affecting unknown contentpen are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / ContentPen
0 < 1.1.1
References
Credits
Enrico Marcolini Claudio Marchesini Dottor Marc WPScan