CVE-2026-88903

The Topcontent WordPress plugin versions through 1.2.1 is vulnerable to an unauthenticated stored XSS via a content webhook. The root cause is improper authorization of a request handler combined with the disabling of HTML sanitisation before storing submitted content. This allows unauthenticated...