CVE-2026-22355
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-01-27
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| gregmolnar | simple_xml_sitemap | From 1.0 (inc) to 1.3 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-352 | The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2026-22355 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress Simple XML Sitemap Plugin (versions up to and including 1.3). It allows an attacker to trick authenticated users with higher privileges into performing unwanted actions by having them click a malicious link, visit a crafted page, or submit a form. This can lead to Stored Cross-Site Scripting (XSS) attacks. Exploitation requires user interaction but no authentication is needed to initiate the attack. [1]
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to execute malicious scripts in the context of an authenticated user's session, potentially leading to unauthorized actions or data compromise. However, the overall impact is considered low priority and unlikely to be exploited. It requires user interaction and targets users with higher privileges, which could lead to security breaches if successfully exploited. [1]
What immediate steps should I take to mitigate this vulnerability?
Since no official fix or patched version is currently available, immediate mitigation involves minimizing user interaction with untrusted links or pages that could exploit the CSRF vulnerability. Administrators should educate users, especially those with higher privileges, to avoid clicking suspicious links or submitting forms from untrusted sources. Additionally, monitoring and restricting access to the Simple XML Sitemap plugin or disabling it temporarily may reduce risk. [1]