The Jenst WP Sitemap WordPress plugin versions up to 1.0 contain an SQL Injection vulnerability due to improper neutralization of special elements in SQL commands. This allows an attacker with low privileges to execute crafted SQL commands remotely without user interaction. The CVSS 3.1 base score is 8.5, reflecting high severity with network attack vector, low attack complexity, privileges required, no user interaction, and a scope change. The impact includes high confidentiality impact and low availability impact, with no integrity impact. No patch or vendor advisory information is currently available.

Successful exploitation could allow an attacker to execute unauthorized SQL commands on the affected system, potentially leading to unauthorized disclosure of sensitive data (confidentiality impact) and partial denial of service (availability impact). Integrity is not impacted according to the CVSS vector. The vulnerability requires low privileges but no user interaction and is exploitable remotely over the network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, consider restricting access to the affected plugin or disabling it if feasible to reduce exposure.