CVE-2026-6712 is a stored Cross-Site Scripting vulnerability in the Website LLMs.txt plugin for WordPress, affecting all versions up to 8.2.6. The vulnerability occurs due to improper neutralization of input during web page generation, specifically insufficient sanitization and escaping of admin settings input. Authenticated users with administrator privileges can inject arbitrary scripts that execute in the context of other users visiting the injected pages. This vulnerability impacts multi-site WordPress installations or those with unfiltered_html disabled. The CVSS 3.1 base score is 4.4 (medium severity), with attack vector network, high attack complexity, high privileges required, no user interaction, and partial impact on confidentiality and integrity.

An attacker with administrator-level access can exploit this vulnerability to inject malicious scripts that execute in the browsers of users who visit the compromised pages. This can lead to partial confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed on behalf of users. The vulnerability does not affect availability. Exploitation requires high privileges and affects multi-site or restricted HTML capability WordPress setups.

No official patch or remediation is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. Until a fix is released, restrict administrator access to trusted users only and consider disabling or limiting the use of the Website LLMs.txt plugin in multi-site or unfiltered_html-disabled environments. Review and sanitize admin inputs manually where possible. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.