The iXML – Google XML sitemap generator plugin is vulnerable to reflected XSS because the iXML_email URL parameter is not properly sanitized or escaped. An unauthenticated attacker can embed malicious scripts in a crafted link; when a user follows the link the plugin renders the parameter value, causing the browser to execute the attacker’s code. This can lead to session cookie theft, credential phishing, site defacement or the initiation of further malicious activity in the victim’s session.

All WordPress sites that have the iXML – Google XML sitemap generator plugin installed in version 0.6 or earlier are affected. The flaw resides in the iXML.php file, where the iXML_email parameter is directly output without validation.

The CVSS base score of 6.1 indicates medium severity, while the EPSS score of less than 1 % shows a very low current exploitation probability. The vulnerability is not listed in CISA’s KEV catalog. Attackers only need to craft a malicious URL and convince a user to click it—no authentication or special configuration is required—so the risk is moderate but off‑the‑wall exploitation remains unlikely at present.