The XML Sitemap Generator for Google WordPress plugin before 2.0.4 does not validate a parameter which can be set to an arbitrary value, thus causing XSS via error message or RCE if allow_url_include is turned on.
CVSS 3.1MEDIUM 6.1·Network·No auth·User interaction·EPSS 0.02067·Published 2022-05-23·Fixed in 2.0.4CWE-79