Simple Sitemap – Responsive HTML Sitemap for WordPress

Simple Sitemap – Responsive HTML Sitemap for WordPress has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2025; all 5 are fixed as of September 2026. Their average CVSS score is 5.5, and the most serious one scores 6.4 out of 10. 2023 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 2 of the records (40%). Other recurring categories include Missing Authorization, Cross-Site Request Forgery (CSRF).

Every one of the 5 issues recorded for Simple Sitemap – Responsive HTML Sitemap for WordPress has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, one record each. Simple Sitemap – Responsive HTML Sitemap for WordPress is installed on roughly 60,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium
5.5/ 10
Patch Coverage100%
Open

0

Fixed

5

Get automatic notifications for all Simple Sitemap – Responsive HTML Sitemap for WordPress vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2022-4472

Simple Sitemap <= 3.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Read the full analysis

Vulnerability Records

5 records
Simple Sitemap – Responsive HTML Sitemap for WordPress banner
Latestv3.8.0

Simple Sitemap – Responsive HTML Sitemap for WordPress

David Gwyer

Author

David Gwyer

3.9(72)
78/100
Last Updated
2026-09-01 (12d ago)
Active Installs
60,000+
Downloads
1,838,210
Requires WP
6.3+
Requires PHP
7.4+
Tested up to
WP 7.1
Created
2010-06-30 (16y ago)

Simple Sitemap adds a visible, visitor-friendly HTML sitemap to your WordPress site. Add a block, choose what to show, and preview the result directly in the editor before you publish. It is designed for HTML sitemaps that help people browse your content. It does not replace the XML sitemap used by search engines. Build your sitemap in the editor The free edition includes: Three editor blocks: Simple Sitemap, Simple Sitemap Group, and Child Pages. Live preview while you configure the sitemap. Standard lists and responsive tabbed layouts. Posts and pages with ascending or descending ordering. Sorting by title, author, date, ID, menu order, comment count, or random order. Optional excerpts, post-type labels, and linked or plain-text items. Include only selected posts or pages, or exclude individual IDs. Display a published child-page hierarchy for a selected parent page. Optional linked pagination for content lists and individual grouped sections. Page-depth and parent-page-link controls. Multiple sitemaps on the same page. Global item and nested-level spacing presets, with optional per-block and per-shortcode overrides. An optional linked parent at the root of the Child Pages block. The [simple-sitemap] and [simple-sitemap-group] shortcodes for classic content and page-builder workflows. Sitemap styles load only on pages that contain a sitemap. Each sitemap also receives its own ID, so multiple instances can be configured and styled independently. Go further with Simple Sitemap Pro Explore Simple Sitemap Pro when you need more control for a larger or more structured site. Pro adds: Custom post types and custom taxonomies. Taxonomy-term filters and automatic exclusion of child pages. Advanced responsive tab controls and horizontal layouts. Dedicated Taxonomy Terms, Navigation Menu, Archive Links, and WooCommerce Product Sitemap blocks. Enhanced Child Pages controls for subtree exclusions, excerpts, images, and nofollow links, including hierarchical custom post types. Optional separators and compact featured-image thumbnails for child-page sitemaps, including the [simple-sitemap-child] shortcode. Per-section Content Sitemap ordering, limits, and include/exclude rules. Optional noindex filtering for Yoast SEO, Rank Math, and SEOPress, plus current-language filtering for WPML and Polylang. Additional shortcodes for child pages, taxonomy terms, and navigation menus. Interface controls for sitemap colours and presentation. Filters for custom development requirements. Both editions keep the same WordPress-first workflow, so you can start with the free plugin and upgrade when the site requires the additional controls.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C