Support » Plugin: XML Sitemaps » Plugin removed from repository

  • Wordfence just notified me of this critical problem:

    * The Plugin “Google XML Sitemaps” has been removed from wordpress.org

    Was the plugin removed for security reasons, or because it’s gone out of maintenance, or has it transitioned to a different plugin?

    I’m wondering how important it is to replace the plugin on all sites that use it.

Viewing 11 replies - 16 through 26 (of 26 total)
  • chillpanda

    (@chillpanda)

    @fmosse Seeing as how the closure prevents downloading the plugin and that the new patch, noted as version 4.1.2 was meant to patch the security issue, until we can update the plugin, it will continue to be a vulnerability that exists until it’s patched. So while I can’t say whether or not the inference is regarding a malicious plugin or a malicious actor exploiting the plugin, it’s probably better safe than sorry.

    @casi800 if you were to ask me, I wouldn’t be able to tell you. I still have it on my site primarily because on the front end, the Author is appropriately showing someone that isn’t Arne, which lines up with part of the information that lists @Auctollo as the plugin’s current author, with credits still attributing Arne as normal. However, when clicking on Auctollo’s name from the plugins list, it still directs me to the amebrachholde.de website. It would seem his last reply mentioned 4 months and a week ago that there would be a new rollout in the early part of [this] year. So while I do find their lack of reply to this thread to be somewhat suspicious, or any sort of reply being provided to the numerous other unanswered posts albeit having updated the source code just a week ago, it’s really hard to say definitively whether or not the plugin has been compromised in some way.
    It also doesn’t help that the website listed for @auctollo doesn’t seem to be working from my end. It’s also worth noting that although Auctollo was at pone point actively replying to support related submissions going as far back as a year ago, it seems to consistently be a generic message of “Thank you for reaching out..” and “…our team is working on it”. I suppose it’s always better to be safe than sorry unless we can get some input from WordPress.org about plugin’s current status. Or if a developer could review the code that was submitted to help make sense of whether or not the new code may contain malicious code or something.
    Otherwise, there are plenty of other substitutes that do the same thing available from the plug in repository. So, to be sure, I am removing it myself, just to be safe, and for now.

    @blazingmoonorg Thank you Mr. Giesler for doing all that and relaying the information here. It’s definitely alarming and concerning to hear the lack of information surrounding the plugin. Interestingly enough, when taking precaution and logging in to remove the plugin after reading your text, it would seem the plugin had a notification on my WordPress dashboard asking me to fill out a survey linked to a Google Forms page. While I refrained from filling out the survey, there just seems to be too many parts of the matter that seem off and I’d rather be safe than sorry.

    @cdgweb @gadhiyaravi @coyotech I have not found that file either, whilst my /mu-plugins/ directory appears to be empty from file manager. And, just to be safe I SSH’d into the server in case of hidden files and found it to be empty as well. However, admittedly, I had gone to check after removing the plugin already.

    Consider switching to the WordPress 5.5 and newer built in sitemap. Anytime I can get rid of a plugin is good!

    Wordpress created Sitemap located at:
    domainname/wp-sitemap.xml

    If have another sitemap plugin running, it may prevent you from accessing that url.

    This plugin gives you some control over it.
    https://wordpress.org/plugins/wp-sitemaps-config/

    • This reply was modified 3 months, 3 weeks ago by nfong.
    Thread Starter Andy Giesler

    (@blazingmoonorg)

    Great tip @nfong. Somehow I missed that WordPress announcement about built-in sitemap support.

    I’ve removed Google XML Sitemaps from all the sites I manage, and I don’t plan to replace it with another specialized sitemap plugin. My reasoning:

    • There are questions around how important XML sitemaps are for SEO with small to medium sites that have good internal linking. All my sites fall into that category.
    • WordPress includes XML sitemap support as of 5.5.
    • If I ever need finer control (for example, to hide certain post types or category types), the plugin @nfong mentioned provides that, as do several popular generalized plugins that bundle an XML sitemap feature.

    I’ll leave this topic open for a little longer in the hope that someone can definitively clarify what’s going on…but I’m done worrying about it.

    I’ve also removed this plugin from my sites for now. WordPress show the plugin was updated 11 hours ago (to 4.1.3?) so some work is taking place. An update would have been nice from the current author.

    Pel

    (@pelstudio)

    Thanks @nfong for the tip re: core Sitemaps in WP 5.5. That’s the direction we’re taking our clients as well.

    I am also deleting the plugin from all the sites I administate. It´s very strange this situation because usually when WordPress closes a plugin is because a security brach

    I deleted it off all of my sites a few days after it was pulled from the repository. I didn’t know about the default sitemap, either! I do manage a lot of sites that either have CPTs or use templates that might otherwise be indexed if not excluded. But I mostly use SEOPress Pro, so that covers it.

    cbconsult

    (@carolinbenjamin)

    I was not aware of the default sitemap — and will test that on a future site.

    What I ended up doing on the current client sites that were using the old defunct XML Sitemaps plug was to take the plug off the websites and activate the XML sitemap feature on Yoast – since these client websites were also using Yoast, but with the XML sitemap feature turned off. If XML worked ok on Yoast I’ll likely leave these current sites on that for the moment.

    But definitely want to test out that default sitemap feature on a future site.

    Thanks to whoever brought that solution to my attention.

    how long to wait,Plugin review over a month.

    Bliss7

    (@bliss7)

    There may a reason to keep using this plugin even though it seems iffy now.

    If you have a website ranking well, would removing the plugin and replacing with another affect the rankings, even if albeit temporarily?

    Would you risk this?

    I am struggling with this dilemma. But the author or owner of this plugin has not even updated us (the users) about how it’s going.

    Iffy….. sigh/

    Moderator Steven Stern (sterndata)

    (@sterndata)

    Forum Moderator & Support Team Rep

    A sitemap is a sitemap; it doesn’t matter which plugin generates it.

    As this topic is going nowhere, I’m going to close it.

Viewing 11 replies - 16 through 26 (of 26 total)
  • The topic ‘Plugin removed from repository’ is closed to new replies.