The Website LLMs.txt plugin for WordPress is vulnerable to reflected XSS because it processes the 'tab' parameter with filter_input() without sanitization and fails to escape output. An unauthenticated attacker can inject arbitrary JavaScript that will execute in a browser when a page containing the reflected value is loaded, enabling session hijacking, data theft, or defacement. This flaw is classified as CWE‑79 and affects only the reflection of user input.

The vulnerability applies to the Website LLMs.txt plugin developed by ryhowa and is present in all WordPress installations running version 8.2.6 or earlier. No other vendors or product variants are mentioned.

The CVSS score of 6.1 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at present. The flaw is not listed in the CISA KEV catalog. Attackers can exploit this vulnerability by crafting a malicious URL that includes a payload in the 'tab' parameter and persuading a site administrator to click the link, such as via phishing or social engineering. No authentication is required to trigger the reflected script, but successful execution could grant the attacker the privileges of the administrator who loads the page.