What is the CVSS score of CVE-2026-6712?

CVE-2026-6712 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Website Llms Txt CVE-2026-6712

EUVD-2026-24072 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-21 Wordfence

GHSA-xm9m-jhp8-mhhx

WordPress XSS Website Llms Txt Wordpress Plugin

4.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 21, 2026 - 07:26 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 07:15 euvd

EUVD-2026-24072

Analysis Generated

Apr 21, 2026 - 07:15 vuln.today

CVE Published

Apr 21, 2026 - 06:43 nvd

MEDIUM 4.4

DescriptionCVE.org

The Website LLMs.txt plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 8.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

AnalysisAI

Stored cross-site scripting in Website LLMs.txt plugin for WordPress versions up to 8.2.6 allows authenticated administrators to inject arbitrary JavaScript into plugin settings that executes when any user visits affected pages. The vulnerability requires high privilege level (PR:H) and occurs only in multi-site installations or where unfiltered_html capability is disabled. No public exploit code or active exploitation has been identified.

Technical ContextAI

The Website LLMs.txt WordPress plugin fails to properly sanitize user input in its admin settings interface and does not adequately escape output when rendering those settings on front-end pages. This is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) vulnerability. The vulnerability is triggered through the WordPress admin panel, where authenticated users with administrator-level permissions can inject malicious HTML and JavaScript payloads into plugin configuration fields. These payloads are stored in the WordPress database and then rendered without proper escaping when accessed by other users, causing the injected scripts to execute in their browsers within the context of the website's origin.

RemediationAI

Update the Website LLMs.txt plugin to version 8.2.7 or later, which includes fixes for input sanitization and output escaping in admin settings. The patched version is available through the WordPress plugin repository at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3482210%40website-llms-txt&new=3482210%40website-llms-txt. If immediate patching is not possible, restrict the administrator role to trusted users only and consider re-enabling the unfiltered_html capability in single-site installations (if security policy permits), which would prevent the vulnerability from being exploitable since administrators would already have unrestricted HTML capabilities. Additionally, limit access to the plugin settings page using WordPress role/capability filters or web server access controls to reduce the surface for administrator account compromise.