WordPress VP Sitemap plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin VP Sitemap versions = 1.0...

CVE-2023-46627

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Ashish Ajani WordPress Simple HTML Sitemap plugin = 2.1 versions...

CVE-2023-46627

CVE-2023-46627 affects WordPress plugin WP Simple HTML Sitemap (wp-simple-html-sitemap) up to version 2.2. The vulnerability is an unauthenticated Cross-Site Scripting (XSS) via the id parameter (Reflected XSS). Patch/mitigation: upgrade to version 2.3 or later. This CVE entry is supported by Pat...

WordPress Plugin WordPress Simple HTML Sitemap Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2023-45067

The CVE-2023-45067 affects WordPress plugin WordPress Simple HTML Sitemap (

The vulnerability of the Sitemap plugin in the click5 content management system for WordPress allows a hacker to create an administrator-account and perform a CSRF attack.

The vulnerability of the Sitemap plugin in the click5 content management system for WordPress is related to deficiencies in the authentication process. Exploiting this vulnerability could allow a malicious actor to create an account with administrator privileges and carry out a CSRF attack...

CVE-2022-4545

The Sitemap WordPress plugin before 4.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users...

Cross site scripting

The Sitemap WordPress plugin before 4.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users...

PT-2023-14672 · WordPress · Sitemap Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Sitemap WordPress plugin versions prior to 4.4 Description: The issue concerns the Sitemap WordPress plugin, where it fails to validate and escape certain shortcode attributes before outputting them, potentially allowing Stored Cross-Site...

WordPress plugin Sitemap 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

Simple Sitemap < 3.5.8 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Exploit...

Simple Sitemap < 3.5.8 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. PoC Exploit...

Kwayy HTML Sitemap < 4.0 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC 1. Click the 'Settings' button of this plugin...

WordPress Sitemap by click5 plugin存在未明漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Sitemap by click5 plugin version 1.0.36 has a security vulnerability that could be exploite...

CVE-2021-36912 Andrea Pernici News Sitemap for Google plugin <= 1.0.16 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability in Andrea Pernici News Sitemap for Google plugin = 1.0.16 on WordPress, attackers must have contributor or higher user role...

CVE-2022-0952

CVE-2022-0952 affects the WordPress Sitemap by click5 plugin under versions before 1.0.36. The issue is missing authorization/CSRF checks when updating options via a REST endpoint and the update may not verify that the option belongs to the plugin. This allows unauthenticated attackers to change ...

Sitemap by click5 < 1.0.36 - Unauthenticated Arbitrary Options Update

The plugin does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the plugin. As a result, unauthenticated attackers could change arbitrary blog options, such as the userscanregister and defaultrole,...

WordPress WP Disable Sitemap plugin < 1.0.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress WP Disable Sitemap plugin versions 1.0.4. Solution Update the WordPress WP Disable Sitemap plugin to the latest available version at least 1.0.4...

The vulnerability of the `cp_plugins_do_button_job_later_callback` function in the Tree Sitemap WordPress plugin allows a hacker to execute arbitrary code.

The vulnerability of the cppluginsdobuttonjoblatercallback function in the Tree Sitemap WordPress plugin is related to authentication process errors. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

CVE-2021-24192

Low privileged users can use the AJAX action 'cppluginsdobuttonjoblatercallback' in the Tree Sitemap WordPress plugin before 2.9, to install any plugin including a specific version from the WordPress repository, as well as activate arbitrary plugin from then blog, which helps attackers install...