Plugin inspection:

WP HTML Sitemap

Potentially unsafe

Last revised:

Confidence: Medium
This plugin has been given a short, targeted code review.

Before using this plugin, you should very carefully consider its potential problems and should conduct a thorough assessment. Read more about this recommendation.

Warnings

The version of this plugin that this recommendation was based on is known to be vulnerable to attack:

Findings

Generates errors during normal operation. No SQL escaping. Updating settings seems to require a nonce, but Update Sitemap and Delete Sitemap buttons are vulnerable to CSRF. Incompatible with some setups as it attempts to request HTML files via HTTP from the plugin directory.

Reason for the 'Potentially unsafe' result

The plugin contains or is likely to contain a vulnerability which could be exploited by an end user and which would compromise the site’s confidentiality, integrity or availability:

CSRF allowing creating and deleting sitemaps.

Failure criteria

  • Execution of unprepared SQL statements
  • Unsafe request processing
  • Very large codebase

Read more about our failure criteria.