JVN#27052429: WordPress plugin "Google XML Sitemaps" vulnerable to cross-site scripting

The WordPress plugin “Google XML Sitemaps” provided by Arne Brachhold contains a stored cross-site scripting vulnerability (CWE-79).

Impact

In the case where multiple administrators manage the WordPress site with the affected plugin, an administrator with malicious intent may embed an arbitrary script into the plugin settings page. The embedded script may be executed when another administrator logs in and browses the page.

Solution

Update the plugin
Update the plugin according to the information provided by the developer.

Products Affected

• Google XML Sitemaps Version 4.0.9 and earlier