Simple Yearly Archive Vulnerabilities

The Simple Yearly Archive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `posttype` attribute of the `SimpleYearlyArchive` shortcode in all versions up to, and including, 2.2.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for a...

CVSS:

6.4

Affected:

up to 2.2.4

Fixed in:

2.2.5

Disclosed:

Aug 4, 2026

CVE-2026-7441 on NVD →

The Simple Yearly Archive plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 2.1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrative-level permissions and above, to injec...

CVSS:

4.4

Affected:

up to 2.1.8

Fixed in:

2.1.9

Disclosed:

Feb 13, 2023

CVE-2023-25484 on NVD →