CVE-2026-65539 HIGH

CVE-2026-65539: WordPress Kwayy HTML Sitemap plugin <= 4.0 - CSRF to Stored XSS vulnerability

Vendor Bimal Rekhadiya

Product Kwayy HTML Sitemap

Weakness CWE-352 · CSRF

Published July 23, 2026

Last update July 23, 2026

View on NVD All CVEs

CVSS base score

7.1/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction Required

Confidentiality Low

Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

What the vulnerability does

01Description

Unauthenticated Cross Site Request Forgery (CSRF) in Kwayy HTML Sitemap <= 4.0 versions.

Explanation of Vulnerability in Simple Terms

02Summary

Kwayy HTML Sitemap versions up to 4.0 contain a cross-site request forgery (CSRF) vulnerability. An attacker can craft a malicious webpage that, when visited by a site administrator, performs unwanted actions on the site without the admin's knowledge. The vulnerability requires the admin to visit the attacker's page while logged into the site. This can lead to unauthorized changes to site configuration or content.

What an attacker can do

03Attacker Capabilities

Trick a logged-in admin into performing unwanted actions on the site by visiting a malicious webpage.

Potential impact on your site

04Site Impact

Administrators could unknowingly authorize changes to site settings or content via a malicious link or webpage.

Conditions required to exploit

05Prerequisites

Admin must visit attacker-controlled webpage while logged into the site.

Key dates

06Disclosure timeline

July 23, 2026 CVE published

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-65539 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/352.html AskarLabs — CWE-352 write-up Cross-Site Request Forgery

Related vulnerabilities