ContentPen

CVE-2026-123044: The ContentPen WordPress plugin before 1.1.1 discloses its REST API key to unauthenticated users, who can then use it to create posts containing unfiltered Java

CVE-2026-123044 Nov 12, 2026 Source: Vendor

The ContentPen WordPress plugin before 1.1.1 discloses its REST API key to unauthenticated users, who can then use it to create posts containing unfiltered JavaScript, leading to Stored XSS that executes in the browser of any visitor, including administrators.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://nvd.nist.gov/vuln/detail/CVE-2026-123044

Are you credited here? Sign in to claim your line. It is yours immediately, with no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

3 lines

Showing 1–3 of 3

CVE-2026-123044 BR2026-0000-047723 unclaimed

Credited as Enrico Marcolini

CVE-2026-123044 BR2026-0000-047724 unclaimed

Credited as Claudio Marchesini

CVE-2026-123044 BR2026-0000-047725 unclaimed

Credited as Dottor Marc