Website Llms Txt Vulnerabilities

The Website LLMs.txt plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 8.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject...

CVSS:

4.4

Affected:

up to 8.2.6

Fixed in:

8.2.7

Disclosed:

Apr 20, 2026

CVE-2026-6712 on NVD →

The Website LLMs.txt plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 8.2.6. This is due to the use of filter_input() without a sanitization filter and insufficient output escaping. This makes it possible for unauthenticated attackers to...

CVSS:

6.1

Affected:

up to 8.2.6

Fixed in:

8.2.7

Disclosed:

Apr 20, 2026

CVE-2026-6711 on NVD →

Reflected Cross Site Scripting (XSS) vulnerability

CVSS:

7.1

Affected:

up to 8.2.6

Fix:

No patched version reported

Disclosed:

Mar 12, 2026

The Website LLMs.txt plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 8.2.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfull...

CVSS:

6.1

Affected:

up to 8.2.6

Fixed in:

8.2.7

Disclosed:

Mar 12, 2026

CVE-2026-27068 on NVD →