{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39654", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-04-07T10:57:53.260Z", "datePublished": "2026-04-08T08:30:35.896Z", "dateUpdated": "2026-04-09T15:14:39.030Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "wp-simple-html-sitemap", "product": "WP Simple HTML Sitemap", "vendor": "Ashish Ajani", "versions": [{"lessThanOrEqual": "3.8", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Jitlada | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-08T10:28:39.912Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashish Ajani WP Simple HTML Sitemap wp-simple-html-sitemap allows DOM-Based XSS.<p>This issue affects WP Simple HTML Sitemap: from n/a through <= 3.8.</p>"}], "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashish Ajani WP Simple HTML Sitemap wp-simple-html-sitemap allows DOM-Based XSS.This issue affects WP Simple HTML Sitemap: from n/a through <= 3.8."}], "impacts": [{"capecId": "CAPEC-588", "descriptions": [{"lang": "en", "value": "DOM-Based XSS"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-08T08:30:35.896Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/wp-simple-html-sitemap/vulnerability/wordpress-wp-simple-html-sitemap-plugin-3-8-cross-site-scripting-xss-vulnerability?_s_id=cve"}], "title": "WordPress WP Simple HTML Sitemap plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-09T15:14:35.062457Z", "id": "CVE-2026-39654", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-09T15:14:39.030Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-39654", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-09T15:14:35.062457Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-09T15:12:04.691Z"}}], "cna": {"title": "WordPress WP Simple HTML Sitemap plugin <= 3.8 - Cross Site Scripting (XSS) vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Jitlada | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-588", "descriptions": [{"lang": "en", "value": "DOM-Based XSS"}]}], "affected": [{"vendor": "Ashish Ajani", "product": "WP Simple HTML Sitemap", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "3.8"}], "packageName": "wp-simple-html-sitemap", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-08T10:28:39.912Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/wp-simple-html-sitemap/vulnerability/wordpress-wp-simple-html-sitemap-plugin-3-8-cross-site-scripting-xss-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashish Ajani WP Simple HTML Sitemap wp-simple-html-sitemap allows DOM-Based XSS.This issue affects WP Simple HTML Sitemap: from n/a through <= 3.8.", "supportingMedia": [{"type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashish Ajani WP Simple HTML Sitemap wp-simple-html-sitemap allows DOM-Based XSS.<p>This issue affects WP Simple HTML Sitemap: from n/a through <= 3.8.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-08T08:30:35.896Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39654", "state": "PUBLISHED", "dateUpdated": "2026-04-09T15:14:39.030Z", "dateReserved": "2026-04-07T10:57:53.260Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-04-08T08:30:35.896Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashish Ajani WP Simple HTML Sitemap wp-simple-html-sitemap allows DOM-Based XSS.This issue affects WP Simple HTML Sitemap: from n/a through <= 3.8."}], "id": "CVE-2026-39654", "lastModified": "2026-04-08T21:26:35.910", "metrics": {}, "published": "2026-04-08T09:16:36.587", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/wp-simple-html-sitemap/vulnerability/wordpress-wp-simple-html-sitemap-plugin-3-8-cross-site-scripting-xss-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "audit@patchstack.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,3.8]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "WP Simple HTML Sitemap", "source": "cna", "vendor": "Ashish Ajani"}, "product": "wp_simple_html_sitemap", "vendor": "ashish_ajani"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-08T10:04:57.541527+00:00", "value": {"mitigation_remediation": ["Upgrade WP Simple HTML Sitemap to the latest version (3.9 or newer) if available.", "If an upgrade is not immediately possible, disable or remove the plugin to stop the rendering of vulnerable content.", "Verify that no malicious scripts remain in the sitemap pages or database after disabling the plugin.", "Keep WordPress core and all other plugins up to date to reduce overall attack surface."], "summary": {"action": "Patch", "impact": "Cross\u2011Site Scripting in WordPress plugin"}, "threat_synthesis": {"affected_systems": "The issue impacts the WP Simple HTML Sitemap plugin, developed by Ashish Ajani, for all WordPress installations running any release from the outset of the plugin through version 3.8. Users should verify whether their site uses this plugin and confirm the installed version.", "description_and_impact": "A DOM\u2011based Cross\u2011Site Scripting flaw exists in WP Simple HTML Sitemap versions up to 3.8 that allows an attacker to inject malicious scripts through the plugin\u2019s output. The vulnerability can lead to theft of visitor cookies, defacement of the site, or delivery of additional malicious payloads to users who view the affected pages.", "risk_and_exploitability": "The publicly available information does not include a CVSS score or EPSS probability, and the flaw is not listed in the CISA KEV catalog. Based on the description, the attacker likely exploits the plugin by accessing a URL that causes the malicious payload to be rendered in the browser; no advanced authentication is required, making the vulnerability reasonably easy to trigger for any visitor of an affected site."}}}}, "created": "2026-04-08T19:28:18.488301+00:00", "updated": "2026-04-08T19:41:21.516689+00:00", "vendors": ["ashish_ajani", "ashish_ajani$PRODUCT$wp_simple_html_sitemap", "wordpress", "wordpress$PRODUCT$wordpress"]}