CVE-2026-123044

The ContentPen WordPress plugin (versions prior to 1.1.1 ) is vulnerable to an unauthenticated Stored XSS attack. The root cause is the disclosure of its REST API key to unauthenticated users. Attackers can use this key to create posts containing unfiltered JavaScript , which then executes in the...