WordPress Simple XML Sitemap plugin <= 1.3 - CSRF zu Stored XSS Schwachstelle

The primary impact of CVE-2026-22355 is the ability for an attacker to inject arbitrary JavaScript code into the Simple XML Sitemap plugin's data storage. Because this is a Stored XSS vulnerability, the malicious script persists and can be triggered by any user visiting a page affected by the injected script. This could lead to session hijacking, credential theft (e.g., stealing WordPress administrator credentials), defacement of the website, or redirection to malicious sites. The attacker would need to craft a malicious request that exploits the CSRF vulnerability to inject the XSS payload, typically by tricking a legitimate user into clicking a crafted link or visiting a compromised page.

Websites using the Simple XML Sitemap plugin, particularly those with user authentication or sensitive data, are at risk. Shared WordPress hosting environments are particularly vulnerable as attackers could potentially exploit this vulnerability on multiple websites hosted on the same server. Sites using older, unmaintained versions of WordPress are also at higher risk.

• wordpress / composer / npm:

grep -r "<script" /var/www/html/wp-content/plugins/simple-xml-sitemap/

• wordpress / composer / npm:

wp plugin list --status=inactive | grep simple-xml-sitemap

• wordpress / composer / npm:

wp plugin list | grep simple-xml-sitemap

1. 2026-01-22Disclosure

   disclosure

1. Reserviert2026-01-07
2. Veröffentlicht2026-01-22
3. Geändert2026-04-28
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2026-22355 is to immediately update the Simple XML Sitemap plugin to a version that addresses the CSRF vulnerability. If upgrading is not immediately feasible, implement CSRF protection mechanisms at the WordPress level, such as using a security plugin that adds CSRF tokens to all forms. Additionally, consider implementing a Web Application Firewall (WAF) with CSRF protection rules to block malicious requests. Regularly review WordPress plugin installations and remove any unused or outdated plugins to reduce the attack surface. After upgrading, confirm the vulnerability is resolved by attempting to trigger the XSS payload and verifying that it is blocked or sanitized.

Aktive Installationen

100

Plugin-Bewertung