---
id: "CVE-2026-123044"
page: "https://infrastack.ai/live/CVE-2026-123044"
kind: "vulnerability"
aliases: ["CVE-2026-123044"]
title: "ContentPen WordPress plugin leaks REST API key, enabling stored XSS"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["contentpen", "package", "wordpress"]
not_affected_if: ["plugin-not-installed", "version-1.1.1-or-later"]
published_at: "2026-11-12T06:17:12+00:00"
first_seen_at: "2026-11-12T06:36:53+00:00"
updated_at: "2026-11-12T06:37:58+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123044", "first_seen_at": "2026-11-12T06:36:53+00:00"}]
exploit_sources: []
---

# ContentPen WordPress plugin leaks REST API key, enabling stored XSS

Link for people: https://infrastack.ai/live/CVE-2026-123044 (this .md is for agents)

The ContentPen WordPress plugin before 1.1.1 exposes its REST API key to unauthenticated visitors. An attacker can use that key to publish posts with unfiltered JavaScript, which runs in the browser of anyone who views them, including administrators.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed ContentPen plugin version in the WordPress admin under Plugins; versions below `1.1.1` are affected.
- Confirm whether the plugin is active on the site.

## Fix

- ContentPen WordPress plugin: `1.1.1` or later (fixed version named in the CVE description).

## Timeline

- 2026-11-12T06:36:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123044

## From the sources

The ContentPen WordPress plugin before 1.1.1 discloses its REST API key to unauthenticated users, who can then use it to create posts containing unfiltered JavaScript, leading to Stored XSS that executes in the browser of any visitor, including administrators.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_