Topcontent
Monthly
WordPress sites running the Topcontent plugin through version 1.2.1 are exposed to stored cross-site scripting when the plugin's API key has never been configured, because an unauthenticated request handler lacks authorization and stores submitted content as posts without HTML sanitization. Publicly available exploit code exists, and a victim must load the malicious post for the injected JavaScript to execute. The issue is rated 8.8 by the input CVSS but the independent assessment assigns a more limited impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting that exploitation requires an unconfigured API key and user interaction; it is not confirmed as actively exploited in CISA KEV.
WordPress sites running the Topcontent plugin through version 1.2.1 are exposed to stored cross-site scripting when the plugin's API key has never been configured, because an unauthenticated request handler lacks authorization and stores submitted content as posts without HTML sanitization. Publicly available exploit code exists, and a victim must load the malicious post for the injected JavaScript to execute. The issue is rated 8.8 by the input CVSS but the independent assessment assigns a more limited impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting that exploitation requires an unconfigured API key and user interaction; it is not confirmed as actively exploited in CISA KEV.