{"id":"CVE-2023-6492","aliases":["EUVD-2023-58723","GHSA-wwpm-9qcf-fc8v"],"status":"published","title":"Simple Sitemap \u003c= 3.5.13 - Cross-Site Request Forgery via admin_notices","description":"The Simple Sitemap – Create a Responsive HTML Sitemap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.13. This is due to missing or incorrect nonce validation in the 'admin_notices' hook found in class-settings.php. This makes it possible for unauthenticated attackers to reset the plugin options to a default state via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00196,"percentile":0.09382,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-352"],"published":"2024-06-14T03:35:41Z","modified":"2026-06-17T06:50:51Z","products":[{"vendor":"david gwyer","product":"simple sitemap – create a responsive html sitemap"},{"vendor":"dgwyer","product":"simple sitemap – create a responsive html sitemap"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a228e60c-c91b-4a82-8b05-a0ffaed82524?source=cve","tags":["x_transferred"]},{"url":"https://plugins.trac.wordpress.org/changeset/3099425/simple-sitemap/trunk/lib/classes/plugin-admin-pages/class-settings.php","tags":["x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6492"},{"url":"https://github.com/advisories/GHSA-wwpm-9qcf-fc8v"}],"sources":{"cve":[{"id":"CVE-2023-6492","title":"Simple Sitemap \u003c= 3.5.13 - Cross-Site Request Forgery via admin_notices","description":"The Simple Sitemap – Create a Responsive HTML Sitemap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.13. This is due to missing or incorrect nonce validation in the 'admin_notices' hook found in class-settings.php. This makes it possible for unauthenticated attackers to reset the plugin options to a default state via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","status":"published","published":"2024-06-14T03:35:41.577Z","modified":"2026-04-08T17:12:35.07Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:35:25.095989Z"}],"euvd":[{"id":"EUVD-2023-58723","description":"The Simple Sitemap – Create a Responsive HTML Sitemap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.13. This is due to missing or incorrect nonce validation in the 'admin_notices' hook found in class-settings.php. This makes it possible for unauthenticated attackers to reset the plugin options to a default state via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","status":"published","published":"2024-06-14T03:35:41Z","modified":"2026-04-08T17:12:35Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:24:46.695326Z"}],"ghsa":[{"id":"GHSA-wwpm-9qcf-fc8v","title":"The Simple Sitemap – Create a Responsive HTML Sitemap plugin for WordPress is vulnerable to Cross...","description":"The Simple Sitemap – Create a Responsive HTML Sitemap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.13. This is due to missing or incorrect nonce validation in the 'admin_notices' hook found in class-settings.php. This makes it possible for unauthenticated attackers to reset the plugin options to a default state via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","status":"published","published":"2024-06-14T06:34:46Z","modified":"2026-04-08T21:32:47Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:07:19.756691Z"}],"nvd":[{"id":"CVE-2023-6492","description":"The Simple Sitemap – Create a Responsive HTML Sitemap plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.5.13. This is due to missing or incorrect nonce validation in the 'admin_notices' hook found in class-settings.php. This makes it possible for unauthenticated attackers to reset the plugin options to a default state via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.","status":"published","published":"2024-06-14T04:15:17.503Z","modified":"2026-06-17T06:50:51.02Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:09:17.205287Z"}]}}