CVE-2026-6711

The Website LLMs.txt plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 8.2.6. This is due to the use of filter_input() without a sanitization filter and insufficient output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.

• CWE-79

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3482210%40website-llms-txt&new=3482210%40website-llms-txt&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/f5af155b-b65e-4cb1-a748-fc0fc5c6176d?source=cve

Published

Apr 21, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6703The Responsive Blocks – Page Builder for Blocks & Patterns p…4.3
• CVE-2026-6704The Blog Settings plugin for WordPress is vulnerable to Refl…6.1
• CVE-2026-6706Improper access control in the vault documentation feature …6.5
• CVE-2026-6708The HEL Online Classroom: AI-powered Online Classrooms plugi…5.3
• CVE-2026-6709The Coinbase Commerce for Contact Form 7 plugin for WordPres…4.3
• CVE-2026-6710The Skysa Text Ticker App plugin for WordPress is vulnerable…4.3
• CVE-2026-6712The Website LLMs.txt plugin for WordPress is vulnerable to S…4.4
• CVE-2026-6713GitLab has remediated an issue in GitLab CE/EE affecting all…5.3
• CVE-2026-6716Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-67173Pivotick did not validate the URL scheme of node imagePath v…5.1
• CVE-2026-67174Pivotick contains a DOM-based cross-site scripting vulnerabi…9.2
• CVE-2026-67178MISP installation scripts generated an Apache HTTP virtual-h…7.8