---
id: CVE-2026-88903
title: >-
  The Topcontent WordPress plugin through 1.2.1 does not properly authorise one
  of its request handlers and disables HTML sanitisation before storing the
  submitted content, allowing unauthenticated attackers to publish arbitrary
  posts cont…
summary: >-
  The Topcontent WordPress plugin through 1.2.1 does not properly authorise one
  of its request handlers and disables HTML sanitisation before storing the
  submitted content, allowing unauthenticated attackers to publish arbitrary
  posts cont…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-79
published: '2026-10-11'
updated: '2026-10-11'
sourceUpdated: '2026-10-11T12:17:25.997'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-88903'
references:
  - url: 'https://wpscan.com/vulnerability/173b07dd-6404-49c0-9e01-90b5b68d1dec/'
    label: contact@wpscan.com
tags:
  - nvd
ingestedAt: '2026-10-11T08:44:24.724Z'
epss: 0.00172
epssPercentile: 0.06076
---

## Overview

The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted content, allowing unauthenticated attackers to publish arbitrary posts containing malicious JavaScript on any site where its API key has never been configured.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.