What is the CVSS score of CVE-2026-39654?

CVE-2026-39654 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

WP Simple HTML Sitemap CVE-2026-39654

EUVD-2026-20321 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-08 Patchstack

GHSA-5hwx-hv3g-4j7m

WordPress XSS Wp Simple Html Sitemap Wordpress Plugin

5.9

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.9 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

4.8 MEDIUM

Admin-level privilege required to inject payload (PR:H); victim must load the page (UI:R); no direct availability impact identified for DOM XSS here.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 24, 2026 - 08:11 vuln.today

CVSS changed

Apr 29, 2026 - 10:22 NVD

5.9 (MEDIUM)

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20321

CVE Published

Apr 08, 2026 - 08:30 nvd

N/A

DescriptionCVE.org

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ashish Ajani WP Simple HTML Sitemap wp-simple-html-sitemap allows DOM-Based XSS.This issue affects WP Simple HTML Sitemap: from n/a through <= 3.8.

AnalysisAI

DOM-Based XSS in WP Simple HTML Sitemap WordPress plugin (all versions through 3.8) allows high-privilege authenticated attackers to inject client-side scripts that execute in a victim's browser context when they visit the affected sitemap page. The CVSS vector (PR:H/UI:R/S:C) confirms that exploitation is constrained by admin-level access and required victim interaction, materially limiting real-world impact. No active exploitation is confirmed - EPSS sits at 0.03% (8th percentile) and SSVC classifies exploitation as none with partial technical impact.

Technical ContextAI

WP Simple HTML Sitemap is a WordPress plugin authored by Ashish Ajani (CPE: cpe:2.3:a:ashish_ajani:wp_simple_html_sitemap:*:*:*:*:*:*:*:*) that generates HTML sitemaps for WordPress sites. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), specifically the DOM-Based XSS variant, meaning attacker-supplied data is written to the browser DOM by client-side JavaScript without adequate sanitization. Unlike reflected or stored XSS processed server-side, DOM-Based XSS payloads may never traverse the server, potentially bypassing server-side WAF rules that inspect HTTP responses. The Scope:Changed metric in the CVSS vector indicates the injected script can affect resources outside the plugin's own origin context.

RemediationAI

No exact patched version number is confirmed in the available data - the vulnerability spans all releases through 3.8, but a fixed release beyond 3.8 is not named in any current reference. Administrators should check the WordPress plugin repository for an update beyond version 3.8 and apply it immediately upon availability. As an interim compensating control, restrict WordPress administrator role assignments to the minimum required personnel, reducing the pool of users who could inject a payload. If the HTML sitemap feature is not actively required, deactivating or fully removing the WP Simple HTML Sitemap plugin eliminates exposure without side effects. Monitor the Patchstack advisory page (https://patchstack.com/database/Wordpress/Plugin/wp-simple-html-sitemap/vulnerability/wordpress-wp-simple-html-sitemap-plugin-3-8-cross-site-scripting-xss-vulnerability?_s_id=cve) for patch confirmation.