What is the CVSS score of CVE-2026-6711?

CVE-2026-6711 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

WordPress CVE-2026-6711

EUVD-2026-24071 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-21 Wordfence

GHSA-pwg2-rh4x-6xr7

XSS WordPress

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 21, 2026 - 07:27 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 07:15 euvd

EUVD-2026-24071

Analysis Generated

Apr 21, 2026 - 07:15 vuln.today

CVE Published

Apr 21, 2026 - 06:43 nvd

MEDIUM 6.1

DescriptionCVE.org

The Website LLMs.txt plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 8.2.6. This is due to the use of filter_input() without a sanitization filter and insufficient output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.

AnalysisAI

Reflected cross-site scripting (XSS) in the Website LLMs.txt WordPress plugin versions up to 8.2.6 allows unauthenticated attackers to inject arbitrary JavaScript via the 'tab' parameter due to improper use of filter_input() without sanitization and insufficient output escaping. Exploitation requires social engineering an administrator to click a malicious link, but once successful grants the attacker ability to execute scripts in the admin's browser session with access to sensitive WordPress functions and data.

Technical ContextAI

The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic reflected XSS flaw. The plugin uses PHP's filter_input() function to retrieve the 'tab' parameter from user input; however, filter_input() without a specified sanitization filter (e.g., FILTER_SANITIZE_STRING or FILTER_VALIDATE_*) merely retrieves the value without any filtering or validation. The retrieved data is then output to the HTML page without proper escaping using functions like esc_html(), esc_attr(), or esc_url(). This allows an attacker to craft a URL containing JavaScript payload in the 'tab' parameter that executes in the victim's browser. The affected product is the Website LLMs.txt plugin for WordPress (CPE: cpe:2.3:a:ryhowa:website_llms.txt:*:*:*:*:*:*:*:*), affecting all versions through 8.2.6.

RemediationAI

Update the Website LLMs.txt plugin to version 8.2.7 or later, which implements proper input sanitization via filter_input() with appropriate FILTER_SANITIZE_* parameters and output escaping using esc_html(), esc_attr(), or esc_url() depending on context. Patch availability is confirmed per the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/f5af155b-b65e-4cb1-a748-fc0fc5c6176d). Until patched, a compensating control is to restrict administrator access to the plugin's settings pages via web application firewall (WAF) rules blocking requests with suspicious 'tab' parameters (e.g., containing script tags or event handlers), though this may interfere with legitimate functionality. Additionally, educate administrators against clicking links from untrusted sources, particularly those containing query parameters with unusual or encoded values.