What is the CVSS score of CVE-2026-65539?

CVE-2026-65539 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.1%.

Which versions of Kwayy HTML Sitemap are affected by CVE-2026-65539?

The Kwayy HTML Sitemap WordPress plugin (versions ≤4.0) contains a CSRF-to-Stored-XSS vulnerability that allows attackers to inject persistent malicious scripts into compromised websites by deceiving…

How to fix or mitigate CVE-2026-65539?

Within 24 hours: disable the Kwayy HTML Sitemap plugin immediately and review administrative action logs for the past 90 days to identify any unauthorized changes or script injections. Within 7 days: either remove the plugin entirely or upgrade to a version beyond 4.0 if available; scan the WordPress installation using Wordfence or Sucuri for backdoors or malicious code; audit and reset all administrator account credentials. Within 30 days: implement and enforce multi-factor authentication for all WordPress administrator accounts; deploy Content Security Policy headers to mitigate XSS impact; establish a formal plugin maintenance and vulnerability-monitoring process to detect similar risks in the future.

Kwayy HTML Sitemap CVE-2026-65539

EUVD-2026-48140 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-07-23 Patchstack

GHSA-wc7j-93c4-x4rh

WordPress CSRF Wordpress Plugin Kwayy Html Sitemap

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network CSRF with no attacker privileges but required victim interaction (UI:R); stored XSS crosses into the admin's browser context (S:C) with low C/I/A impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 12:27 vuln.today

CVE Published

Jul 23, 2026 - 11:19 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions.

AnalysisAI

Cross-site request forgery in the Kwayy HTML Sitemap WordPress plugin (versions <= 4.0) lets a remote attacker forge state-changing requests that, per the Patchstack advisory, chain into stored cross-site scripting (CSRF-to-Stored-XSS). By tricking a logged-in administrator into loading a crafted page, an attacker can inject persistent script into the site. No public exploit is identified at time of analysis, and it is not listed in CISA KEV.

Technical ContextAI

The affected component is the Kwayy HTML Sitemap plugin for WordPress (CPE cpe:2.3:a:bimal_rekhadiya:kwayy_html_sitemap), which generates human-readable HTML sitemaps of site content. The root-cause class is CWE-352 (Cross-Site Request Forgery): a plugin action handler processes a state-changing request without validating an anti-CSRF nonce, so the WordPress request-verification model (which normally requires a valid nonce token per privileged action) is bypassed. Because the Patchstack title indicates the CSRF leads to stored XSS, the forged request writes attacker-controlled data that is later rendered without sanitization/output-encoding, planting persistent JavaScript in the WordPress database.

RemediationAI

No vendor-released patch version is identified in the available data (versions <= 4.0 are affected and no fixed release is named), so treat mitigation as primary: consult the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/kwayy-html-sitemap/vulnerability/wordpress-kwayy-html-sitemap-plugin-4-0-csrf-to-stored-xss-vulnerability) for any released fix and upgrade to a patched version above 4.0 as soon as one is published. In the interim, consider deactivating and removing the Kwayy HTML Sitemap plugin (side effect: loss of the HTML sitemap feature and any embedded sitemap pages), or deploy a WAF / virtual patch such as Patchstack that filters CSRF and stored-XSS payloads to this plugin's endpoints. Additionally, enforce administrator awareness against clicking untrusted links while logged in, and apply a restrictive Content-Security-Policy to blunt execution of injected inline scripts (trade-off: CSP tuning may break legitimate inline scripts on the site).