Simple Sitemap – Responsive HTML Sitemap for WordPress
Simple Sitemap – Responsive HTML Sitemap for WordPress has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2025; all 5 are fixed as of September 2026. Their average CVSS score is 5.5, and the most serious one scores 6.4 out of 10. 2023 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 2 of the records (40%). Other recurring categories include Missing Authorization, Cross-Site Request Forgery (CSRF).
Every one of the 5 issues recorded for Simple Sitemap – Responsive HTML Sitemap for WordPress has a vendor fix available, so running the current release closes all known holes.
4 independent researchers contributed these findings, one record each. Simple Sitemap – Responsive HTML Sitemap for WordPress is installed on roughly 60,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2022-4472Simple Sitemap <= 3.5.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Read the full analysisVulnerability Records

Simple Sitemap – Responsive HTML Sitemap for WordPress
Author
David Gwyer
Simple Sitemap adds a visible, visitor-friendly HTML sitemap to your WordPress site. Add a block, choose what to show, and preview the result directly in the editor before you publish. It is designed for HTML sitemaps that help people browse your content. It does not replace the XML sitemap used by search engines. Build your sitemap in the editor The free edition includes: Three editor blocks: Simple Sitemap, Simple Sitemap Group, and Child Pages. Live preview while you configure the sitemap. Standard lists and responsive tabbed layouts. Posts and pages with ascending or descending ordering. Sorting by title, author, date, ID, menu order, comment count, or random order. Optional excerpts, post-type labels, and linked or plain-text items. Include only selected posts or pages, or exclude individual IDs. Display a published child-page hierarchy for a selected parent page. Optional linked pagination for content lists and individual grouped sections. Page-depth and parent-page-link controls. Multiple sitemaps on the same page. Global item and nested-level spacing presets, with optional per-block and per-shortcode overrides. An optional linked parent at the root of the Child Pages block. The [simple-sitemap] and [simple-sitemap-group] shortcodes for classic content and page-builder workflows. Sitemap styles load only on pages that contain a sitemap. Each sitemap also receives its own ID, so multiple instances can be configured and styled independently. Go further with Simple Sitemap Pro Explore Simple Sitemap Pro when you need more control for a larger or more structured site. Pro adds: Custom post types and custom taxonomies. Taxonomy-term filters and automatic exclusion of child pages. Advanced responsive tab controls and horizontal layouts. Dedicated Taxonomy Terms, Navigation Menu, Archive Links, and WooCommerce Product Sitemap blocks. Enhanced Child Pages controls for subtree exclusions, excerpts, images, and nofollow links, including hierarchical custom post types. Optional separators and compact featured-image thumbnails for child-page sitemaps, including the [simple-sitemap-child] shortcode. Per-section Content Sitemap ordering, limits, and include/exclude rules. Optional noindex filtering for Yoast SEO, Rank Math, and SEOPress, plus current-language filtering for WPML and Polylang. Additional shortcodes for child pages, taxonomy terms, and navigation menus. Interface controls for sitemap colours and presentation. Filters for custom development requirements. Both editions keep the same WordPress-first workflow, so you can start with the free plugin and upgrade when the site requires the additional controls.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C