A DOM‑based Cross‑Site Scripting flaw exists in WP Simple HTML Sitemap versions up to 3.8 that allows an attacker to inject malicious scripts through the plugin’s output. The vulnerability can lead to theft of visitor cookies, defacement of the site, or delivery of additional malicious payloads to users who view the affected pages.

The issue impacts the WP Simple HTML Sitemap plugin, developed by Ashish Ajani, for all WordPress installations running any release from the outset of the plugin through version 3.8. Users should verify whether their site uses this plugin and confirm the installed version.

The publicly available information does not include a CVSS score or EPSS probability, and the flaw is not listed in the CISA KEV catalog. Based on the description, the attacker likely exploits the plugin by accessing a URL that causes the malicious payload to be rendered in the browser; no advanced authentication is required, making the vulnerability reasonably easy to trigger for any visitor of an affected site.