Topcontent plugin EUVD-2026-96776

The decisive prerequisite, stated in the description, is that the site's Topcontent API key has NEVER been configured - the vulnerable request handler is reachable and unauthorised only in that unconfigured state, so actively-configured installations are not affected. No authentication is required (PR:N), but exploitation is a stored-XSS pattern requiring user interaction (UI:R): a victim (administrator or visitor) must subsequently load the attacker-published post for the JavaScript to execute. Limiting factors: the plugin must be installed and left with no API key, and the payload only triggers when the malicious post is viewed, so impact depends on victim browsing behaviour and the privileges of whoever views it.

The input CVSS of 8.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) rates this HIGH, driven by network vector, low complexity and no privileges - consistent with the description of an unauthenticated, broken-authorization request handler that stores unsanitised content. However, the signals partially conflict: this is a CWE-79 stored-XSS/content-injection flaw, and the NVD C:H/I:H/A:H impact rating appears inflated for XSS (typical stored XSS is C:L/I:L/A:N with a scope change into the victim browser), so the 8.8 likely overstates direct impact - see assessed vectors below. A publicly available exploit (WPScan) raises practical risk and argues for prompt patching, but there is NO CISA KEV listing and NO EPSS score in the provided data, so there is no evidence of active or widespread exploitation - POC availability must not be conflated with exploitation. Crucially, exploitation is gated by a specific precondition: it only works 'on any site where its API key has never been configured,' meaning fresh/unconfigured installs rather than actively-used deployments, which materially narrows the real-world attack surface. Net: a legitimate patch-worthy issue because it is unauthenticated with a public POC, but the inflated impact metrics and the unconfigured-key precondition suggest the true priority is moderate rather than critical.

An unauthenticated attacker discovers a WordPress site running the Topcontent plugin (≤1.2.1) whose API key has never been configured, and sends a crafted request to the improperly-authorised handler to publish a post with HTML sanitisation disabled. Because the content is stored verbatim, embedded JavaScript executes in the browser of any administrator or visitor who views the malicious post (UI:R), enabling session/credential theft or admin actions. A public exploit is available via WPScan, lowering the skill barrier.