WordPress security by component

Simple Yearly Archive

Plugin description

Simple Yearly Archive is a WordPress component with 2 published CVE records in this archive. The latest tracked vulnerability was published Aug 05, 2026; the highest published CVSS base score is 6.4.

Plugin slug: simple-yearly-archive

Latest vulnerability

CVE-2026-7441: Simple Yearly Archive posttype shortcode attribute permits stored XSS

Simple Yearly Archive through 2.2.4 lets a Contributor store an attacker-controlled posttype attribute in the SimpleYearlyArchive shortcode. The value is not sufficiently sanitized or escaped before page output, allowing stored JavaScript to execute for visitors to the injected page, including administrators. The CNA does not disclose the rendering function or exact HTML context.

PublishedAug 05, 2026

Known safe version> 2.2.4

Published vulnerabilities for simple-yearly-archive
		Safe version
Aug 05, 2026	CVE-2026-7441 Simple Yearly Archive posttype shortcode attribute permits stored XSS Simple Yearly Archive through 2.2.4 lets a Contributor store an attacker-controlled posttype attribute in the SimpleYearlyArchive shortcode. The value is not sufficiently sanitized or escaped before page output, allowing stored JavaScript to execute for visitors to the injected page, including administrators. The CNA does not disclose the rendering function or exact HTML context.	> 2.2.4	CVE6.4 NVDPending
Apr 25, 2023	CVE-2023-25484 Simple Yearly Archive: Cross-site scripting Simple Yearly Archive is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The public source does not disclose the vulnerable endpoint, action, parameter or function, so the precise input path remains unknown.	See mitigation notes	CVE5.9 NVD4.8

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers