Scanners flag XSS and authorization flaws in the plugin
Scanners flag the plugin for XSS and missing-authorization vulnerabilities in several releases.
Tier I · Proven The best-established problems.
7 public reports · first reported 20 October 2023 · last reported 28 June 2026
What's going wrong
Site owners running WP Simple HTML Sitemap keep receiving alerts from security scanners, hosts and agencies that the plugin has cross site scripting and missing authorization checks in several versions. Some reports came from ManageWP, Wordfence and WP Engine, and some owners ask whether a fix is coming soon. Agencies managing many client sites are especially exposed because they cannot quickly verify which installs run a vulnerable version. There is an opening for a service that tracks plugin advisories and tells owners exactly which sites need updating and what to change.
AI-assisted: written with the help of AI from the reports.
Products affected
WP Simple HTML Sitemap.
Related problems
Who has this problem
2 businesses found.
Unlock them at the top of this page — $38.
All sales are final — no refunds.
Each business's name, the address it published, and the page it was published on. Paid through Stripe; you get a private page to bookmark, with a CSV download.