My XML sitemap contains spam content, while the HTML sitemap is not. What can I do?

Question

My website just recovered from an attack. I find out that my XML sitemap still contains spam contents:

<url>
<loc>http://xn--qucu-hr5aza.com/7pwclknq****hux0rx.so</loc>
<lastmod>2020-04-13</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>http://xn--qucu-hr5aza.com/a0***u</loc>
<lastmod>2020-04-13</lastmod>
<changefreq>daily</changefreq>
</url>
<url>
<loc>http://xn--qucu-hr5aza.com/mp412******msm2ayay</loc>
<lastmod>2020-04-13</lastmod>
<changefreq>daily</changefreq>
</url>

However, my HTML sitemap is clean.

I'm using the Google (XML) Sitemaps Generator for WordPress, but it doesn't have a "refresh" or "reindex" button.

Is there a way to deal with this? And why can the attacker be able to change my sitemap? Assuming they don't have my FTP password.

Answer 1

1. First scan your website using https://sitecheck.sucuri.net/ and see if you have any malicious code in your website.
2. Once its clean, try to remove the old xml file and then reinstall Google XML plugin to create a fresh sitemap.

I hope it helps, if there is still an issue do post here.