CVE-2026-6711

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Website LLMs.txt plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 8.2.6. This is due to the use of filter_input() without a sanitization filter and insufficient output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick an administrator into performing an action such as clicking on a link.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Apr 21, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-67124.4The Website LLMs.txt plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and includi CVE-2026-67135.3GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 CVE-2026-671655.4HCL Connections is vulnerable to a cross-site scripting attack where an attacker may leverage this issue to execute arbitrary script code in CVE-2026-671715.3HCL BigFix Service Management is affected by an Information Disclosure vulnerability because an exposed API endpoint exposes sensitive inter CVE-2026-671723.7HCL BigFix Service Management is affected by an Information Disclosure vulnerability the application returns sensitive information in error CVE-2026-671735.1Pivotick did not validate the URL scheme of node imagePath values derived from graph data before assigning them to SVG image resources. An a CVE-2026-671749.2Pivotick contains a DOM-based cross-site scripting vulnerability in its generic UI element resolution and icon-rendering utilities. The try CVE-2026-671787.8MISP installation scripts generated an Apache HTTP virtual-host configuration containing an incorrectly formatted HTTP-to-HTTPS redirect: R CVE-2026-671797.8Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits (via DNS r CVE-2026-67186.2IBM Concert 1.0.0 through 3.0.0 is vulnerable to improper access control which allows unauthorized modification of application files.CVE-2026-671808.4Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing request or influence CVE-2026-671815.4Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchronize HTTP message boun