CVE-2026-13701 is a stored cross-site scripting vulnerability in the Advanced Excerpt WordPress plugin versions prior to 4.5. The vulnerability arises because the plugin does not properly sanitize and escape one of its settings before rendering it on the front end. This allows an administrator, even without unfiltered_html privileges, to inject malicious JavaScript code that executes in the browsers of visitors to affected pages, potentially leading to session hijacking, defacement, or other XSS-related impacts.

An attacker with administrator privileges can exploit this vulnerability to perform stored XSS attacks that execute arbitrary JavaScript in the context of any visitor viewing the affected pages. This can lead to theft of cookies, session tokens, or other sensitive information, as well as unauthorized actions performed on behalf of the visitor. The vulnerability affects multisite WordPress installations where administrators lack unfiltered_html capability, broadening the scope of potential exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid using the affected plugin version or restrict administrative access to trusted users only. Monitoring for updates from the plugin vendor or WordPress security channels is recommended to apply any forthcoming patches promptly.