Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
The Website LLMs.txt plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 8.2.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-21 | 1 | Disclosure1 |
| 2026-04-25 | 1 | PoC1 |
https://atomicedge.io/cve-proof/cve-2026-6712-website-llms-txt-version-8-2-6-medium-vulnerability-proof-of-concept CVE-2026-6712 #WordPress plugin #vulnerability website-llms-txt #cybersecurity #wordpressfirewall #wordpresssecurity #hacking #wpsecurity #atomicedge
Post summary
A proof‑of‑concept for CVE‑2026‑6712 targeting the WordPress plugin website‑llms‑txt v8.2.6 is referenced in the linked resource.
CVE-2026-6712 The Website LLMs.txt plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 8.2.6 due to insufficien… https://www.cve.org/CVERecord?id=CVE-2026-6712
Post summary
The post reports a stored XSS vulnerability in the Website LLMs.txt WordPress plugin affecting all versions up to 8.2.6.