Stored XSS Vulnerability in ContentPen WordPress Plugin by the Developer
CVE-2026-123044

Currently unrated

Key Information:

Vendor

WordPress
Status
Contentpen
Vendor
CVE Published:
12 November 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-123044?

A vulnerability has been identified in the ContentPen WordPress plugin, wherein it improperly exposes its REST API key to unauthenticated users. This exposure allows unauthorized individuals to create posts containing unfiltered JavaScript. Consequently, this leads to stored Cross-Site Scripting (XSS) attacks, which can execute harmful scripts in the browsers of any visitor, including site administrators. It is essential for users of the plugin to update to version 1.1.1 or later to mitigate this security risk.

Affected Version(s)

ContentPen 0 < 1.1.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-123044 - Proof of Concept

References

https://wpscan.com/vulnerability/646b9448-ee17-4852-8f42-...
exploitvdb-entrytechnical-description

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

Credit

Enrico Marcolini
Claudio Marchesini
Dottor Marc
WPScan
.