CVE-2026-7441

Name of the Vulnerable Software and Affected Versions Simple Yearly Archive versions prior to 2.2.5

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping on user supplied attributes. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts via the posttype attribute of the SimpleYearlyArchive shortcode. These scripts execute whenever a user accesses the affected page.

Recommendations Update Simple Yearly Archive to version 2.2.5 or later. As a temporary mitigation, restrict the ability of users with Contributor-level access to edit pages or posts containing the SimpleYearlyArchive shortcode.