{
 "id": "WPSEC-2026-0809",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0809/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0809/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0809/index.md",
 "title": "Jekyll Exporter <= 4.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Exported Markdown Content",
 "description": "The Static Site Exporter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via exported post content in all versions up to, and including, 4.3.0. The cause is the bundled league/html-to-markdown library (5.1.2), which entity-decoded the content of <code> and <pre> elements and wrapped it in a fixed single or triple backtick fence without escaping. It also did not properly escape attribute values of HTML it kept as-is, or the href, src, title and alt values of links and images. Post content that passed WordPress's HTML filtering could therefore break out of the Markdown it was written into and turn into raw HTML in the exported files. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts into the Markdown the plugin generates. The scripts run for visitors of a static site built from that export, once the post is published, an administrator exports the site, and the site generator renders raw HTML.",
 "plugin": {
  "slug": "jekyll-exporter",
  "name": "Jekyll Exporter",
  "full_name": "Static Site Exporter",
  "wordpress_org": "https://wordpress.org/plugins/jekyll-exporter/",
  "advisories_url": "https://wpsec.com/vuln/plugin/jekyll-exporter/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/jekyll-exporter"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.4,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "4.4.0",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 4.4.0"
  ]
 },
 "introduced_in": null,
 "fixed_in": "4.4.0",
 "remediation": "Update to 4.4.0 or later.",
 "fix_released": "2026-10-11T20:41:12+00:00",
 "published": "2026-10-12T20:49:55+00:00",
 "updated": "2026-10-12T09:38:20.533896+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0809/",
  "https://plugins.svn.wordpress.org/jekyll-exporter/tags/4.4.0/",
  "https://wordpress.org/plugins/jekyll-exporter/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/jekyll-exporter",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-12"
 }
}