CVE Catalog
CVE-2026-39654
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk0.17%
7th percentile - higher than 7% of all known CVEs
Summary
The WP Simple HTML Sitemap plugin for WordPress is vulnerable to DOM-based XSS. Lack of proper input sanitization allows script injection.
Risk Assessment
Risk includes execution of malicious JavaScript in the user's browser, potentially leading to data theft or session hijacking.
Recommendation
Update the WP Simple HTML Sitemap plugin to a version above 3.8 as soon as a patch is available.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashish Ajani WP Simple HTML Sitemap wp-simple-html-sitemap allows DOM-Based XSS.This issue affects WP Simple HTML Sitemap: from n/a through <= 3.8.