CVE-2026-13701
Advanced Excerpt < 4.5 - Admin+ Stored XSS via Ellipsis Setting
- State
- Published
- Severity
- 4.8 Medium
- Published
- Aug 10, 2026
- Updated
- Aug 10, 2026
- Reserved
- Jun 29, 2026
Description
The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it on the front end of the site, which could allow administrators (including those without the unfiltered_html capability, such as on multisite) to perform Stored Cross-Site Scripting attacks that execute in the context of any visitor viewing affected pages.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 4.8 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N | CISA-ADP |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
Advanced ExcerptUnknown |
|
References
- https://wpscan.com/vulnerability/2710686c-055c-460c-8480-573e394f24d8/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.