The Gary Illyes Google XML News Sitemap plugin version 0.02 and earlier contains a CSRF vulnerability that enables stored XSS attacks. This means an attacker can trick an authenticated user into submitting a crafted request that results in malicious script being stored and later executed in the context of the affected site. The vulnerability is remotely exploitable without privileges but requires user interaction. The CVSS 3.1 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability at a low to low level.

Successful exploitation can lead to stored XSS, allowing attackers to execute arbitrary scripts in the context of the affected site, potentially compromising user data, session tokens, or site integrity. The CSRF aspect means attackers can induce authenticated users to perform unwanted actions. The overall impact affects confidentiality, integrity, and availability at a low level but is considered high severity due to the combined effects and ease of exploitation.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory or plugin updates regularly for any released fixes. Until a patch is available, consider disabling or removing the affected plugin to mitigate risk. Implementing standard CSRF protections and input sanitization may help but are dependent on plugin updates.