CVE-2026-123044— ContentPen < 1.1.1 - Unauthenticated Stored XSS via API Key Disclosure
Quick assessment
Affected
Unknown ContentPen
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
ContentPen WordPress 插件 1.1.1 版本之前的版本存在安全漏洞，会将 REST API 密钥泄露给未认证用户。攻击者可利用该密钥创建包含未过滤 JavaScript 代码的帖子，从而引发存储型跨站脚本（Stored XSS）攻击。该恶意脚本将在任何访问者（包括管理员）的浏览器中执行。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-123044
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ContentPen < 1.1.1 - Unauthenticated Stored XSS via API Key Disclosure
Source: CVE Program / CVE List V5
Vulnerability Description
The ContentPen WordPress plugin before 1.1.1 discloses its REST API key to unauthenticated users, who can then use it to create posts containing unfiltered JavaScript, leading to Stored XSS that executes in the browser of any visitor, including administrators.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Unknown | ContentPen | 0 ~ 1.1.1 | - |
|
II. Public POCs for CVE-2026-123044
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-123044
请登录查看更多情报信息。
Other References for CVE-2026-123044 (1)
-
https://wpscan.com/vulnerability/646b9448-ee17-4852-8f42-c086625e5983/ exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-11-12 · 21 CVEs total
| CVE-2026-121498 | Askany < 2.2.1 - Unauthenticated Chat Session Disclosure and Modification via IDOR | |
| CVE-2026-110072 | Photo Gallery by 10Web < 1.8.49 - Contributor+ Stored XSS via watermark_url Shortcode Attr | |
| CVE-2026-110041 | Crop-Thumbnails < 1.10.0 - Author+ Arbitrary Attachment Read and Overwrite via crop REST E | |
| CVE-2026-106027 | Oxygen MyData for WooCommerce 3.0.0 - 3.0.8 - Unauthenticated Arbitrary Order Completion v | |
| CVE-2026-110959 | Descope < 1.2.0 - Unauthenticated Account Takeover | |
| CVE-2026-119039 | Defender Security 4.9.0 - 6.4.0 - Unauthenticated IP Address Spoofing via Smart IP Detecti | |
| CVE-2026-118421 | WP Directory Kit < 1.6.3 - Listing Admin+ SQL Injection via 'order_by' Parameter | |
| CVE-2026-118531 | Directorist < 8.11.1 - Subscriber+ Listing Moderation Bypass via REST Status Update | |
| CVE-2026-119040 | Defender Security < 6.4.1 - 2FA Bypass via Unthrottled OTP Verification | |
| CVE-2026-122003 | Abilities Bridge < 1.4.2 - Administrator Account Creation via CSRF | |
| CVE-2026-76792 | User Verification 2.0.38 - 2.0.48 - Unauthenticated Account Takeover via Unthrottled OTP L | |
| CVE-2026-123092 | WP Remote Users Sync < 2.3.0 - Privilege Escalation to Administrator via 'meta' Sync Actio | |
| CVE-2026-124652 | Mine CloudVod < 2.6.6 - Subscriber+ Order Information Disclosure via IDOR | |
| CVE-2026-124653 | Mine CloudVod < 2.6.6 - Unauthenticated Cloud Storage Credential Disclosure | |
| CVE-2026-124647 | TI WooCommerce Wishlist < 2.0.7 - Unauthenticated SQLi via tinv_wishlistkey Cookie | |
| CVE-2026-124648 | TI WooCommerce Wishlist < 2.13.0 - Unauthenticated Wishlist Item Deletion via Share Key | |
| CVE-2026-124815 | Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record Deletion Actions | |
| CVE-2026-124814 | Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticated Arbitrary File Upload via 't | |
| CVE-2026-124817 | Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modification | |
| CVE-2026-124665 | Order Tracking < 3.6.2 - Unauthenticated Customer and Sales Rep Order History Disclosure v |
IV. Related Vulnerabilities
Same vendor: Unknown
-
CVE-2026-76792
User Verification 2.0.38 - 2.0.48 - Unauthenticated Account -
CVE-2026-124665
Order Tracking < 3.6.2 - Unauthenticated Customer and Sales -
CVE-2026-124817
Clockinator Lite < 1.1.0 - Unauthenticated Leave Record Modi -
CVE-2026-124814
Ultimate Addons for Elementor Forms < 1.0.8 - Unauthenticate -
CVE-2026-124815
Clockinator Lite < 1.1.0 - Unauthenticated SQLi via Record D