CVE-2026-88903
Received Received - Intake

Unauthenticated Stored XSS in Topcontent WordPress Plugin

Publication date: 2026-10-11

Last updated on: 2026-10-11

Assigner: WPScan

Description
The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted content, allowing unauthenticated attackers to publish arbitrary posts containing malicious JavaScript on any site where its API key has never been configured.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-11
Last Modified
2026-10-11
Generated
2026-10-11
AI Q&A
2026-10-11
EPSS Evaluated
N/A
NVD
CVE-2026-88903
EUVD
EUVD-2026-96776

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown Topcontent 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Topcontent WordPress plugin through version 1.2.1 has a flaw where it does not properly authorize one of its request handlers. This flaw disables HTML sanitization before storing submitted content, allowing unauthenticated attackers to publish posts with malicious JavaScript on sites where the plugin's API key was never configured.

Detection Guidance

Check if the Topcontent WordPress plugin version 1.2.1 or earlier is installed. Look for unauthorized posts containing suspicious JavaScript code. Inspect network traffic for unconfigured API key requests to the plugin's webhook endpoint.

Impact Analysis

Unauthenticated attackers can exploit this to inject malicious JavaScript into posts on your WordPress site. This could lead to stolen user data, session hijacking, or defacement of your website if the plugin's API key was not set up.

Compliance Impact

This vulnerability could lead to data breaches by allowing attackers to steal user data via malicious scripts. This may violate GDPR (data protection) and HIPAA (health data privacy) requirements, potentially resulting in legal penalties and reputational damage.

Mitigation Strategies

Update the Topcontent WordPress plugin to the latest version immediately. If an update is unavailable, consider disabling the plugin until a patch is released. Review all posts for unauthorized content and remove any malicious JavaScript.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88903. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart