This vulnerability in WP Simple HTML Sitemap (versions <= 3.8) involves improper neutralization of input during web page generation, resulting in a DOM-based cross-site scripting (XSS) issue. The flaw allows untrusted input to be executed as code in the user's browser, potentially enabling script injection attacks. The vulnerability was published on April 8, 2026, and no CVSS score or official remediation level has been provided. The plugin is not a cloud service, and no patch links or vendor advisories are currently available.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary scripts in the context of the affected website's users. This may lead to session hijacking, defacement, or redirection to malicious sites. However, there are no known exploits in the wild at this time, and the extent of impact depends on the attacker's ability to inject malicious input into the vulnerable plugin's output.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the WP Simple HTML Sitemap plugin if feasible, or apply any available workarounds recommended by the vendor. Monitor the vendor's channels for updates and apply patches promptly once available.