Jekyll Exporter <= 4.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Exported Markdown Content
- ID
- WPSEC-2026-0809
- Plugin
- Static Site Exporter (jekyll-exporter)
- Affected
- all versions before 4.4.0
- Remediation
- Update to 4.4.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-12
- Attack surface
- Jekyll Exporter on WPSec AttackSurface
- Fix released
- Published
Description
The Static Site Exporter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via exported post content in all versions up to, and including, 4.3.0. The cause is the bundled league/html-to-markdown library (5.1.2), which entity-decoded the content of <code> and <pre> elements and wrapped it in a fixed single or triple backtick fence without escaping. It also did not properly escape attribute values of HTML it kept as-is, or the href, src, title and alt values of links and images. Post content that passed WordPress's HTML filtering could therefore break out of the Markdown it was written into and turn into raw HTML in the exported files. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts into the Markdown the plugin generates. The scripts run for visitors of a static site built from that export, once the post is published, an administrator exports the site, and the site generator renders raw HTML.
References
- https://wpsec.com/vuln/WPSEC-2026-0809/
- https://plugins.svn.wordpress.org/jekyll-exporter/tags/4.4.0/
- https://wordpress.org/plugins/jekyll-exporter/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS