Stored Cross-Site Scripting Vulnerability in Simple Yearly Archive Plugin by WordPress

CVE-2026-7441

What is CVE-2026-7441?

The Simple Yearly Archive plugin for WordPress is exposed to a Stored Cross-Site Scripting vulnerability through the posttype parameter in the SimpleYearlyArchive shortcode. This issue arises from inadequate input sanitization and output escaping of user-supplied data in all versions prior to 2.2.4. An attacker with Contributor-level access or higher can exploit this vulnerability by injecting malicious web scripts into the plugin's pages, which will execute when any user visits the affected page. This highlights the necessity for robust validation and sanitization processes in WordPress plugins.

References