CVE-2026-27068: Reflected XSS in Website LLMs.txt

Successful exploitation of this Reflected XSS vulnerability allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can be leveraged to steal sensitive information like cookies and session tokens, enabling account takeover. Attackers could also redirect users to malicious websites, deface the website, or inject malware. The impact is amplified if the website handles sensitive user data or financial transactions, as an attacker could gain access to this information. While the vulnerability is reflected, meaning it requires user interaction (clicking a malicious link), the potential for widespread impact remains significant, especially if the plugin is widely deployed.

1. Reserved2026-02-17
2. Published2026-03-19
3. Modified2026-04-28
4. EPSS updated2026-03-26

The primary mitigation for CVE-2026-27068 is to immediately upgrade the Website LLMs.txt plugin to version 8.2.7 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing a Web Application Firewall (WAF) rule to filter out potentially malicious input. Specifically, look for patterns associated with XSS payloads, such as <script> tags or event handlers. Additionally, carefully sanitize all user-supplied input before rendering it on the website to prevent further XSS vulnerabilities. After upgrading, confirm the fix by attempting to inject a simple XSS payload (e.g., <script>alert(1)</script>) through the vulnerable input field and verifying that the script is not executed.

Active installs

30KKnown

Plugin rating