Cross-Site Scripting Vulnerability in WP Simple HTML Sitemap by Ashish Ajani

CVE-2026-39654

What is CVE-2026-39654?

A vulnerability exists in the WP Simple HTML Sitemap plugin developed by Ashish Ajani, allowing for potential Cross-Site Scripting (XSS) attacks due to improper neutralization of input during web page generation. This weakness can be exploited by malicious actors to inject harmful scripts into web pages viewed by users, potentially compromising sensitive data or performing unwanted actions within the user's browser session. The affected versions are those prior to and including 3.8.

References