high8.8
CVE-2026-88903
The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitt…
Impact
The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted content, allowing unauthenticated attackers to publish arbitrary posts containing malicious JavaScript on any site where its API key has never been configured.
Affected products
| Product | Affected versions |
|---|---|
| Topcontent WordPress Plugin | through 1.2.1 |
Versions were read from the advisory text. No structured product data has been published for this record yet.