# Jekyll Exporter <= 4.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Exported Markdown Content

- **ID:** WPSEC-2026-0809
- **Plugin:** Static Site Exporter (`jekyll-exporter`), https://wordpress.org/plugins/jekyll-exporter/
- **Affected versions:** all versions before 4.4.0
- **Fixed in:** 4.4.0 (Update to 4.4.0 or later.)
- **Severity:** Medium 4.4 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-12)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/jekyll-exporter
- **Fix released:** 2026-10-11
- **Published:** 2026-10-12
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0809/

## Description

The Static Site Exporter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via exported post content in all versions up to, and including, 4.3.0. The cause is the bundled league/html-to-markdown library (5.1.2), which entity-decoded the content of <code> and <pre> elements and wrapped it in a fixed single or triple backtick fence without escaping. It also did not properly escape attribute values of HTML it kept as-is, or the href, src, title and alt values of links and images. Post content that passed WordPress's HTML filtering could therefore break out of the Markdown it was written into and turn into raw HTML in the exported files. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts into the Markdown the plugin generates. The scripts run for visitors of a static site built from that export, once the post is published, an administrator exports the site, and the site generator renders raw HTML.

## References

- https://wpsec.com/vuln/WPSEC-2026-0809/
- https://plugins.svn.wordpress.org/jekyll-exporter/tags/4.4.0/
- https://wordpress.org/plugins/jekyll-exporter/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0809/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.