Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Boot Div WP Sitemap wpsitemap allows Stored XSS.This issue affects WP Sitemap: from n/a through <= 1.0.0.
Published: 2025-04-01
Score: 6.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Boot Div WP Sitemap contains an XSS flaw that lets an attacker insert malicious JavaScript which is stored and then served with normal web pages. This issue is a stored Cross‑Site Scripting vulnerability as described in the CVE payload.

Affected Systems

Any WordPress installation using Boot Div WP Sitemap version 1.0.0 or earlier. The plugin is distributed under the Boot Div:WP Sitemap category.

Risk and Exploitability

The CVSS score of 6.5 places it in a medium severity range. The EPSS score is below 1%, indicating very low likelihood of exploitation at this time, and it is not listed in KEV. Attackers would reach the exposed input points in the plugin’s interface; however, the description does not specify whether authentication is required, so the exact attack vector is inferred rather than stated.

Generated by OpenCVE AI on May 2, 2026 at 02:46 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Boot Div WP Sitemap to the latest version released after 1.0.0
  • If no update is available, uninstall or deactivate the plugin until a fix is issued
  • Implement a web application firewall or site‑wide input sanitization to block malicious script injection

Generated by OpenCVE AI on May 2, 2026 at 02:46 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-9286 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Boot Div WP Sitemap allows Stored XSS. This issue affects WP Sitemap: from n/a through 1.0.0.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Boot Div WP Sitemap allows Stored XSS. This issue affects WP Sitemap: from n/a through 1.0.0. Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Boot Div WP Sitemap wpsitemap allows Stored XSS.This issue affects WP Sitemap: from n/a through <= 1.0.0.
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

Tue, 01 Apr 2025 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 01 Apr 2025 15:00:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Boot Div WP Sitemap allows Stored XSS. This issue affects WP Sitemap: from n/a through 1.0.0.
Title WordPress WP Sitemap Plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:12:11.273Z

Reserved: 2025-04-01T13:18:48.161Z

Link: CVE-2025-31733

cve-icon Vulnrichment

Updated: 2025-04-01T20:33:07.144Z

cve-icon NVD

Status : Deferred

Published: 2025-04-01T15:16:09.320

Modified: 2026-04-23T15:28:08.600

Link: CVE-2025-31733

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-02T03:00:13Z

Weaknesses