Stored Cross-Site Scripting in Website LLMs.txt Plugin for WordPress

CVE-2026-6712

What is CVE-2026-6712?

The Website LLMs.txt plugin for WordPress contains a vulnerability that allows authenticated attackers with administrator-level permissions to execute arbitrary web scripts. This is due to insufficient input sanitization and output escaping in the plugin's admin settings. The issue primarily affects multi-site installations and those configurations where unfiltered HTML is disabled. Attackers can inject malicious scripts that will run whenever users access the compromised pages, potentially leading to unauthorized actions and data exposure.

References