{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-123044", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-11-05T08:34:47.607Z", "datePublished": "2026-11-12T06:00:08.453Z", "dateUpdated": "2026-11-12T06:00:08.453Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-11-12T06:00:08.453Z"}, "title": "ContentPen < 1.1.1 - Unauthenticated Stored XSS via API Key Disclosure", "problemTypes": [{"descriptions": [{"description": "CWE-79 Cross-Site Scripting (XSS)", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "ContentPen", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "1.1.1"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The ContentPen WordPress plugin before 1.1.1 discloses its REST API key to unauthenticated users, who can then use it to create posts containing unfiltered JavaScript, leading to Stored XSS that executes in the browser of any visitor, including administrators."}], "references": [{"url": "https://wpscan.com/vulnerability/646b9448-ee17-4852-8f42-c086625e5983/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Enrico Marcolini", "type": "finder"}, {"lang": "en", "value": "Claudio Marchesini", "type": "finder"}, {"lang": "en", "value": "Dottor Marc", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "ContentPen", "vendor": "Unknown", "versions": [{"lessThan": "1.1.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "contact@wpscan.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The ContentPen WordPress plugin before 1.1.1 discloses its REST API key to unauthenticated users, who can then use it to create posts containing unfiltered JavaScript, leading to Stored XSS that executes in the browser of any visitor, including administrators."}], "id": "CVE-2026-123044", "lastModified": "2026-11-12T06:17:12.920", "metrics": {}, "published": "2026-11-12T06:17:12.920", "references": [{"source": "contact@wpscan.com", "url": "https://wpscan.com/vulnerability/646b9448-ee17-4852-8f42-c086625e5983/"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Received"}

{}

{}