The Simple Yearly Archive plugin for WordPress contains a stored cross‑site scripting vulnerability that is triggered by the posttype attribute of the SimpleYearlyArchive shortcode. The flaw arises because user supplied attributes are not properly sanitized or escaped. An authenticated attacker with Contributor-level access or higher can inject arbitrary JavaScript code into a page, which will execute each time any visitor loads that page. The injected code runs in the context of the site and can enable the attacker to hijack sessions, deface content or otherwise manipulate the site’s functionality.

All WordPress sites that have installed Simple Yearly Archive version 2.2.4 or earlier, published by alphawolf, are affected by this vulnerability when the posttype attribute of the shortcode is used.

The CVSS score of 6.4 indicates a moderate severity risk. The vulnerability is not listed in the CISA KEV catalog and the EPSS score is not available. Exploitation requires only Contributor‑level access, which is commonly granted, making the attack vector largely internal to the site. As a stored XSS flaw, once an attacker places a malicious payload in the shortcode, it will execute for any visitor to the affected page, providing the attacker with a persistent attack surface.