CVE-2022-0346
Google XML Sitemap Generator < 2.0.4 - Reflected Cross-Site Scripting
Vexday Risk Score
18Low
SSVC decision (CISA)
Attend
PoC available → attend closely
CVSS —EPSS 2.2%KEV nãoPoC —Nuclei simMetasploit —Patch —
Lifecycle
23 May 2022Published on NVD
Recommendation: Plan a near-term fix — a public PoC already exists.
The XML Sitemap Generator for Google WordPress plugin before 2.0.4 does not validate a parameter which can be set to an arbitrary value, thus causing XSS via error message or RCE if allow_url_include is turned on.
Affected products
Unknown · XML Sitemap Generator for GoogleWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →