The vulnerability is a Cross‑Site Request Forgery that permits an attacker to store malicious script content within the Google XML News Sitemap plugin configuration. Because the plugin accepts user‑provided input without proper sanitization, the stored payload can execute in the context of any site administrator who views the compromised page. This is a Stored XSS and is classified as CWE‑352.

The affected product is the Google XML News Sitemap plugin by Gary Illyes, versions up to and including 0.02. All installations of the plugin before the resolved version are susceptible.

The CVSS score of 7.1 signals a high impact if exploited. The EPSS score is below 1%, indicating a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. However, because the flaw requires a CSRF request and an authenticated administrator session, an attacker who can craft such a request can achieve persistent cross‑site scripting, potentially compromising user credentials, defacing content, or creating a platform for further attacks.