---
id: CVE-2026-88903
title: >-
  The Topcontent WordPress plugin through 1.2.1 does not properly authorise one
  of its request handlers and disables HTML sanitisation before storing the
  submitted content, allowing unauthenticated attackers to publish arbitrary
  posts cont…
summary: >-
  The Topcontent WordPress plugin through 1.2.1 does not properly authorise one
  of its request handlers and disables HTML sanitisation before storing the
  submitted content, allowing unauthenticated attackers to publish arbitrary
  posts cont…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'
cwe:
  - CWE-79
published: '2026-10-11'
updated: '2026-10-13'
sourceUpdated: '2026-10-13T20:36:00.850'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-88903'
references:
  - url: 'https://wpscan.com/vulnerability/173b07dd-6404-49c0-9e01-90b5b68d1dec/'
    label: contact@wpscan.com
tags:
  - nvd
  - cve.org
epss: 0.00276
epssPercentile: 0.19894
ingestedAt: '2026-10-11T08:44:24.724Z'
product: Topcontent
affected:
  - Topcontent <= 1.2.1
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-11T11:20:16.185589Z'
---

## Overview

The Topcontent WordPress plugin through 1.2.1 does not properly authorise one of its request handlers and disables HTML sanitisation before storing the submitted content, allowing unauthenticated attackers to publish arbitrary posts containing malicious JavaScript on any site where its API key has never been configured.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.