The Simple XML Sitemap plugin for WordPress is vulnerable to a Cross‑Site Request Forgery weakness that allows an attacker to store malicious script code in the site’s database. This stored XSS can execute when an authenticated administrator or a visitor views the affected page, potentially leading to session hijacking, defacement, or credential theft. The weakness is classified as CWE‑352 and reflects the lack of proper CSRF protection for inputs that later are reinjected into the page without sanitization.

WordPress sites using the gregmolnar Simple XML Sitemap plugin version 1.3 or earlier are affected. No specific version numbers are provided beyond the major release threshold; any deployment of the plugin prior to upgrading past 1.3 is susceptible.

The CVSS score of 7.1 indicates a moderate‑to‑high severity. The EPSS score of less than 1% suggests a low probability of widespread exploitation at present. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog, indicating no publicly known exploit code. An attacker would need to get the target to trigger the CSRF request, which could be achieved via a crafted link or malicious email; once the XSS payload is stored, it can affect any page that loads the vulnerable data.