CVE-2026-13701
Last modified
CVE-2026-13701 is a medium-severity vulnerability rated 4.8/10 on the CVSS scale. The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it on the front end of the site, which could allow administrators (including those without the unfiltered_html capability, such as on multisite) to perform Stored Cross-Site Scripting attacks that execute in the context of any visitor viewing affected pages.. EPSS estimates a 0.16% chance of exploitation in the next 30 days.
Description
The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it on the front end of the site, which could allow administrators (including those without the unfiltered_html capability, such as on multisite) to perform Stored Cross-Site Scripting attacks that execute in the context of any visitor viewing affected pages.
Metrics
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Advanced Excerpt | < 4.5 |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-13701?
How severe is CVE-2026-13701?
How do I fix CVE-2026-13701?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-13694The Bit Form WordPress plugin before 3.1.0 does not properl…6.5
- CVE-2026-13696Improper neutralization of special elements used in an LDAP …8.8
- CVE-2026-13697undici's cache interceptor mishandles malformed Cache-Contro…9.1
- CVE-2026-13698A memory leak in OpenVPN version 2.5.0 through 2.5.11, 2.6.0…7.5
- CVE-2026-13699In Eclipse KUKSA Databroker version 0.6.1, the kuksa.val.v2.…6.5
- CVE-2026-1370The SIBS woocommerce payment gateway plugin for WordPress is…4.9
- CVE-2026-13703The SEO Redirection Plugin WordPress plugin before 9.19 doe…5.4
- CVE-2026-13704The GiveWP – Donation Plugin and Fundraising Platform plugin…6.4
- CVE-2026-13705Imager versions before 1.032 for Perl have a heap out-of-bou…7.1
- CVE-2026-13706Improper input validation vulnerability in Wikimedia Foundat…8.8
- CVE-2026-13707Session fixation vulnerability in Wikimedia Foundation OAuth…7.6
- CVE-2026-13708Imager::File::JPEG versions before 1.003 for Perl leak heap …7.5
Are you affected by CVE-2026-13701?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST