CVE-2022-0346: Google XML Sitemap Generator < 2.0.4 - Reflected Cross-Site Scripting

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-05-23 · updated 2026-06-17
Weakness: CWE-79

Description

The XML Sitemap Generator for Google WordPress plugin before 2.0.4 does not validate a parameter which can be set to an arbitrary value, thus causing XSS via error message or RCE if allow_url_include is turned on.

Affected products

XML Sitemap Generator for Google: before 2.0.4 — fixed in 2.0.4

How to fix

Upgrade to a fixed version: XML Sitemap Generator for Google 2.0.4. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/4b339390-d71a-44e0-8682-51a12bd2bfe6
https://wpscan.com/vulnerability/4b339390-d71a-44e0-8682-51a12bd2bfe6

Get alerted when CVE-2022-0346 or the next vulnerability affects your stack