Improper Neutralization of Input During Web Page Generation, classified as CWE‑79, allows stored cross‑site scripting in the WP Visual Sitemap plugin. An attacker can inject malicious scripts that execute in the browsers of any user who views a page rendered by the plugin, potentially leading to session hijacking, defacement, or credential theft.

The WordPress WP Visual Sitemap plugin distributed by MS is affected. All releases up through version 1.0.2 contain the flaw, so sites running any of those versions are vulnerable.

The CVSS score of 6.5 reflects moderate severity. The EPSS score is under 1 percent, and the vulnerability is not listed in the CISA KEV catalog, indicating a low observed exploitation rate. Nonetheless, because the flaw is stored and does not require authentication, an attacker can embed a malicious payload via the plugin’s web interface that will be served to every site visitor, making the risk moderate with a low but real likelihood of exploitation.