EUVD-2026-24071
GHSA-pwg2-rh4x-6xr7
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
The Website LLMs.txt plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 8.2.6. This is due to the use of filter_input() without a sanitization filter and insufficient output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.
AnalysisAI
Reflected cross-site scripting (XSS) in the Website LLMs.txt WordPress plugin versions up to 8.2.6 allows unauthenticated attackers to inject arbitrary JavaScript via the 'tab' parameter due to improper use of filter_input() without sanitization and insufficient output escaping. Exploitation requires social engineering an administrator to click a malicious link, but once successful grants the attacker ability to execute scripts in the admin's browser session with access to sensitive WordPress functions and data.
Technical ContextAI
The vulnerability stems from CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic reflected XSS flaw. The plugin uses PHP's filter_input() function to retrieve the 'tab' parameter from user input; however, filter_input() without a specified sanitization filter (e.g., FILTER_SANITIZE_STRING or FILTER_VALIDATE_*) merely retrieves the value without any filtering or validation. The retrieved data is then output to the HTML page without proper escaping using functions like esc_html(), esc_attr(), or esc_url(). This allows an attacker to craft a URL containing JavaScript payload in the 'tab' parameter that executes in the victim's browser. The affected product is the Website LLMs.txt plugin for WordPress (CPE: cpe:2.3:a:ryhowa:website_llms.txt:*:*:*:*:*:*:*:*), affecting all versions through 8.2.6.
RemediationAI
Update the Website LLMs.txt plugin to version 8.2.7 or later, which implements proper input sanitization via filter_input() with appropriate FILTER_SANITIZE_* parameters and output escaping using esc_html(), esc_attr(), or esc_url() depending on context. Patch availability is confirmed per the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/f5af155b-b65e-4cb1-a748-fc0fc5c6176d). Until patched, a compensating control is to restrict administrator access to the plugin's settings pages via web application firewall (WAF) rules blocking requests with suspicious 'tab' parameters (e.g., containing script tags or event handlers), though this may interfere with legitimate functionality. Additionally, educate administrators against clicking links from untrusted sources, particularly those containing query parameters with unusual or encoded values.
More in Website Llms Txt
View allSame weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today