CVE-2026-13701: Advanced Excerpt < 4.5 - Admin+ Stored XSS via Ellipsis Setting
The Advanced Excerpt WordPress plugin before 4.5 does not sanitise and escape one of its settings before outputting it on the front end of the site, which could allow administrators (including those without the unfilteredhtml capability, such as on multisite) to perform Stored Cross-Site Scripting attacks that execute in the context of any visitor viewing affected pages.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13701?
CVE-2026-13701 has a risk score of 33, indicating a moderate level of severity.
How do I fix CVE-2026-13701?
To fix CVE-2026-13701, update the Advanced Excerpt plugin to version 4.5 or higher.
What type of vulnerability is CVE-2026-13701?
CVE-2026-13701 is a Stored Cross-Site Scripting (XSS) vulnerability.
Who is affected by CVE-2026-13701?
Administrators of WordPress sites using the Advanced Excerpt plugin below version 4.5 are affected by CVE-2026-13701.
What can attackers do with CVE-2026-13701?
Attackers can exploit CVE-2026-13701 to inject malicious scripts into the website, potentially compromising sensitive data or site functionality.