WordPress Plugin Vulnerabilities

ContentPen < 1.1.1 - Unauthenticated Stored XSS via API Key Disclosure

Description

The plugin discloses its REST API key to unauthenticated users, who can then use it to create posts containing unfiltered JavaScript, leading to Stored XSS that executes in the browser of any visitor, including administrators.

Proof of Concept

Affects Plugins

Plugin icon
contentpen
Fixed in 1.1.1

References

CVE
CVE-2026-123044

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.5 (high)

Miscellaneous

Original Researcher
Enrico Marcolini, Claudio Marchesini, Dottor Marc
Submitter
Enrico Marcolini, Claudio Marchesini, Dottor Marc
Submitter website
https://www.dottormarc.it
Verified
Yes
WPVDB ID
646b9448-ee17-4852-8f42-c086625e5983

Timeline

Publicly Published
2026-11-10 (about 2 days ago)
Added
2026-11-10 (about 1 day ago)
Last Updated
2026-11-11 (about 7 hours ago)

Other

Published
Title
Published
2026-05-26
Title
Geo Mashup < 1.13.19 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-04-16
Title
Attendance Manager <= 0.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2023-09-29
Title
Blog Filter <= 1.4 - Contributor+ Stored Cross-Site Scripting
Published
2026-10-02
Title
Disable and Remove Google Fonts | GDPR & DSGVO friendly < 2.0.3 - Reflected Cross-Site Scripting
Published
2026-06-09
Title
Animation Addons for Elementor – GSAP Powered Elementor Addons & Website Templates < 4.2.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via Multiple Parameters