CVE-2026-6712: Website LLMs.txt Plugin XSS Vulnerability

CVE-2026-6712 Overview

CVE-2026-6712 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the Website LLMs.txt plugin for WordPress. The vulnerability exists in all versions up to and including 8.2.6 due to insufficient input sanitization and output escaping in the plugin's admin settings interface. This security flaw enables authenticated attackers with administrator-level permissions to inject arbitrary web scripts into pages that execute whenever a user accesses the compromised page.

Critical Impact

Authenticated attackers with administrator privileges can inject persistent malicious scripts that execute in the context of other users' sessions, potentially leading to session hijacking, credential theft, or further compromise of the WordPress installation.

Affected Products

• Website LLMs.txt plugin for WordPress versions up to and including 8.2.6
• WordPress multi-site installations
• WordPress installations where unfiltered_html capability has been disabled

Discovery Timeline

• 2026-04-21 - CVE-2026-6712 published to NVD
• 2026-04-22 - Last updated in NVD database

Technical Details for CVE-2026-6712

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw resides in the plugin's administrative settings handling, where user-supplied input is not properly sanitized before being stored in the database, nor is it adequately escaped when rendered on output.

The attack requires administrator-level privileges, which limits the attack surface. However, this constraint is particularly relevant in WordPress multi-site environments where site administrators may not be fully trusted by the network administrator. Additionally, when the unfiltered_html capability has been explicitly disabled (a security hardening measure), this vulnerability provides a bypass to inject scripts that would otherwise be blocked.

Root Cause

The root cause of this vulnerability is the failure to implement proper input sanitization on administrative settings fields combined with inadequate output escaping when rendering these values. WordPress provides several functions for sanitization such as sanitize_text_field() and esc_html() for output escaping, which appear to have been insufficiently applied or entirely missing in the affected code paths.

Attack Vector

The attack vector is network-based, requiring an authenticated attacker with administrator-level permissions to access the plugin's settings page and inject malicious JavaScript code into a settings field. Once stored, the malicious script persists in the database and executes whenever the affected page is loaded by any user, including other administrators or in some cases front-end visitors depending on how the setting value is used.

The vulnerability is triggered when stored administrative input containing malicious JavaScript is rendered without proper output escaping. This allows the attacker to execute arbitrary scripts in the browser context of other users who view the affected content.

Detection Methods for CVE-2026-6712

Indicators of Compromise

• Unexpected JavaScript code present in WordPress plugin settings database entries
• Unusual <script> tags or event handlers (e.g., onerror, onload) stored in wp_options table entries related to the Website LLMs.txt plugin
• Browser console errors or unexpected network requests when accessing plugin administration pages

Detection Strategies

• Review WordPress database entries associated with the Website LLMs.txt plugin for embedded script tags or JavaScript event handlers
• Implement Web Application Firewall (WAF) rules to detect XSS payloads in POST requests to WordPress admin pages
• Monitor for changes to plugin configuration options, particularly those containing HTML or script content

Monitoring Recommendations

• Enable WordPress audit logging to track changes to plugin settings by administrators
• Configure SentinelOne Singularity to monitor for suspicious web-based script injection patterns
• Regularly scan WordPress installations for stored XSS indicators using automated security scanning tools

How to Mitigate CVE-2026-6712

Immediate Actions Required

• Update the Website LLMs.txt plugin to a version newer than 8.2.6 that contains the security fix
• Audit existing plugin settings for any previously injected malicious content
• Review administrative user accounts for any unauthorized access or suspicious activity
• Consider temporarily disabling the plugin until the update can be applied

Patch Information

The vulnerability has been addressed in a newer version of the plugin. The security patch modifies how the plugin handles administrative input by implementing proper sanitization and escaping. Technical details of the fix can be reviewed in the WordPress Plugin Changeset. Additional vulnerability information is available in the Wordfence Vulnerability Report.

Workarounds

• Restrict administrator-level access to only trusted users on multi-site installations
• Enable Content Security Policy (CSP) headers to mitigate the impact of XSS attacks
• Implement additional WAF rules to filter common XSS payloads in administrative requests
• Consider using WordPress security plugins that provide runtime XSS protection

# Example: Add Content Security Policy header in Apache .htaccess
Header set Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' https://trusted-cdn.example.com; object-src 'none';"