CVE-2026-6711
Reflected XSS in WordPress LLMs.txt Plugin Allows Admin Attack
Publication date: 2026-04-21
Last updated on: 2026-04-21
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| website_llms | plugin | to 8.2.6 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Website LLMs.txt plugin for WordPress has a Reflected Cross-Site Scripting (XSS) vulnerability in the 'tab' parameter in all versions up to and including 8.2.6.
This vulnerability arises because the plugin uses filter_input() without applying a sanitization filter and does not properly escape output.
As a result, unauthenticated attackers can inject arbitrary web scripts into pages that will execute if an administrator is tricked into clicking a malicious link.
How can this vulnerability impact me? :
This vulnerability can allow attackers to execute arbitrary scripts in the context of the affected website.
If an administrator is tricked into clicking a malicious link, the injected scripts can run with their privileges, potentially leading to unauthorized actions or data exposure.
The CVSS score of 6.1 indicates a medium severity impact, with potential confidentiality and integrity loss but no impact on availability.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability allows unauthenticated attackers to inject arbitrary web scripts that execute when an administrator interacts with a crafted link. This reflected cross-site scripting (XSS) flaw can lead to unauthorized access or manipulation of administrative functions.
Such unauthorized script execution can potentially lead to data breaches or unauthorized access to sensitive information, which may impact compliance with regulations like GDPR and HIPAA that require protection of personal and health data.
However, the provided information does not explicitly detail the direct impact on compliance with these standards.