{"id":"CVE-2026-123044","kind":"vulnerability","aliases":["CVE-2026-123044"],"related":[],"title":"ContentPen WordPress plugin leaks REST API key, enabling stored XSS","description":"The ContentPen WordPress plugin before 1.1.1 discloses its REST API key to unauthenticated users, who can then use it to create posts containing unfiltered JavaScript, leading to Stored XSS that executes in the browser of any visitor, including administrators.","summary":"The ContentPen WordPress plugin before 1.1.1 exposes its REST API key to unauthenticated visitors. An attacker can use that key to publish posts with unfiltered JavaScript, which runs in the browser of anyone who views them, including administrators.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["contentpen","package","wordpress"],"not_affected_if":["plugin-not-installed","version-1.1.1-or-later"],"how_to_check":"- Check the installed ContentPen plugin version in the WordPress admin under Plugins; versions below `1.1.1` are affected.\n- Confirm whether the plugin is active on the site.","fix":"- ContentPen WordPress plugin: `1.1.1` or later (fixed version named in the CVE description).","status":"open","published_at":"2026-11-12T06:17:12+00:00","first_seen_at":"2026-11-12T06:36:53+00:00","triaged_at":"2026-11-12T06:37:58+00:00","updated_at":"2026-11-12T06:37:58+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-12T06:37:58Z","model":"claude-haiku-5-5","output":{"fix":"- ContentPen WordPress plugin: `1.1.1` or later (fixed version named in the CVE description).","reach":"internet","title":"ContentPen WordPress plugin leaks REST API key, enabling stored XSS","impact":"high","summary":"The ContentPen WordPress plugin before 1.1.1 exposes its REST API key to unauthenticated visitors. An attacker can use that key to publish posts with unfiltered JavaScript, which runs in the browser of anyone who views them, including administrators.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","contentpen"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"Attacker runs JavaScript in administrators' browsers, taking over the site","analyst_note":"","how_to_check":"- Check the installed ContentPen plugin version in the WordPress admin under Plugins; versions below `1.1.1` are affected.\n- Confirm whether the plugin is active on the site.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-1.1.1-or-later"],"who_is_affected":"Sites running the ContentPen WordPress plugin before 1.1.1 are exposed, because its REST API key is readable without logging in. Sites without the plugin, or running 1.1.1 or later, are not affected.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000712,"input_tokens":4538,"output_tokens":517,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-123044':13A,16A '-2026':12A,15A '1.1.1':25B,63C 'administr':57B,96C 'anyon':52B 'api':6A,29B,67C 'attack':35B 'browser':50B,91C 'contain':80C 'contentpen':1A,17B,21B,59C 'creat':78C 'cve':11A,14A 'disclos':64C 'enabl':8A 'execut':88C 'expos':26B 'includ':56B,95C 'javascript':45B,82C 'key':7A,30B,39B,68C 'lead':83C 'leak':4A 'packag':18B 'plugin':3A,23B,61C 'post':42B,79C 'publish':41B 'rest':5A,28B,66C 'run':47B 'store':9A,85C 'unauthent':32B,70C 'unfilt':44B,81C 'use':37B,75C 'user':71C 'view':54B 'visitor':33B,94C 'wordpress':2A,19B,22B,60C 'xss':10A,86C","nicknames":[],"mitigations":[],"who_affected":"Sites running the ContentPen WordPress plugin before 1.1.1 are exposed, because its REST API key is readable without logging in. Sites without the plugin, or running 1.1.1 or later, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["contentpen","high","package","wordpress"],"campaign_type":null,"search_a":"'-123044':13A,16A '-2026':12A,15A 'api':6A 'contentpen':1A 'cve':11A,14A 'enabl':8A 'key':7A 'leak':4A 'plugin':3A 'rest':5A 'store':9A 'wordpress':2A 'xss':10A","search_b":"'1.1.1':25B 'administr':57B 'anyon':52B 'api':29B 'attack':35B 'browser':50B 'contentpen':17B,21B 'expos':26B 'includ':56B 'javascript':45B 'key':30B,39B 'packag':18B 'plugin':23B 'post':42B 'publish':41B 'rest':28B 'run':47B 'unauthent':32B 'unfilt':44B 'use':37B 'view':54B 'visitor':33B 'wordpress':19B,22B","search_c":"'1.1.1':63C 'administr':96C 'api':67C 'browser':91C 'contain':80C 'contentpen':59C 'creat':78C 'disclos':64C 'execut':88C 'includ':95C 'javascript':82C 'key':68C 'lead':83C 'plugin':61C 'post':79C 'rest':66C 'store':85C 'unauthent':70C 'unfilt':81C 'use':75C 'user':71C 'visitor':94C 'wordpress':60C 'xss':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T06:17:12+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123044","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123044","severity":null,"published_at":"2026-11-12T06:17:12+00:00","modified_at":"2026-11-12T06:17:12+00:00","first_seen_at":"2026-11-12T06:36:53+00:00","fetched_at":"2026-11-12T06:36:53+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}