Wordfence inserts php code in sitemap

Hello,

I’m using the free version of Wordfence and the plugin “XML Sitemap Generator” from Auctollo, which doesn’t generate “real” XML-files, but virtual sitemaps. When I open the sitemap in the browser, a blank page is shown. If I check the browser source-code, the XML sitemap is shown, but at the end of the sitemap, some lines of php code are inserted by Wordfence (see below). Do you have an idea, why this happens?
Thanks in advance!
Andreas

<!-- <pre>array(55) {
  [0]=>
  array(5) {
    [0]=>
    string(56) "SELECT name, val FROM wp_wfconfig WHERE autoload = 'yes'"
    [1]=>
    float(0.0009191036224365234)
    [2]=>
    string(379) "require('wp-blog-header.php'), require_once('wp-load.php'), require_once('wp-config.php'), require_once('wp-settings.php'), include_once('/plugins/wordfence/wordfence.php'), require_once('/plugins/wordfence/lib/wordfenceClass.php'), wfCredentialsController::useLegacy2FA, wfCredentialsController::allowLegacy2FA, wfConfig::get, wfConfig::hasCachedOption, wfConfig::loadAllOptions"
    [3]=>
    float(1681369112.707069)
    [4]=>
    array(0) {
    }
  }
  [1]=>
  array(5) {
    [0]=>
    string(71) "SELECT name, value FROM wp_wfls_settings WHERE autoload = 'yes'"
    [1]=>
    float(0.0002071857452392578)
    [2]=>
    string(770) "require('wp-blog-header.php'), require_once('wp-load.php'), require_once('wp-config.php'), require_once('wp-settings.php'), include_once('/plugins/wordfence/wordfence.php'), require_once('/plugins/wordfence/lib/wordfenceClass.php'), require('/plugins/wordfence/modules/login-security/wordfence-login-security.php'), WordfenceLS\Controller_WordfenceLS->init, WordfenceLS\Controller_WordfenceLS->_init_actions, WordfenceLS\Controller_Settings::shared, WordfenceLS\Controller_Settings->__construct, WordfenceLS\Controller_Settings->_migrate_admin_2fa_requirements_to_roles, WordfenceLS\Controller_Settings->get_bool, WordfenceLS\Controller_Settings->get, WordfenceLS\Settings\Model_DB->get, WordfenceLS\Settings\Model_DB->_has_cached, WordfenceLS\Settings\Model_DB->_cached"
    [3]=>
    float(1681369112.709457)
    [4]=>
    array(0) {
    }
  }
  [2]=>
  array(5) {
    [0]=>
    string(84) "SELECT name, val, autoload FROM wp_wfconfig WHERE name = 'detectProxyRecommendation'"
    [1]=>
    float(0.0001571178436279297)
    [2]=>
    string(287) "require('wp-blog-header.php'), require_once('wp-load.php'), require_once('wp-config.php'), require_once('wp-settings.php'), include_once('/plugins/wordfence/wordfence.php'), wordfence::install_actions, wfLog->initLogRequest, wfUtils::getIP, wfUtils::getIPAndServerVariable, wfConfig::get"
    [3]=>
    float(1681369112.710769)
    [4]=>
    array(0) {
    }
  }
  [3]=>
  array(5) {
    [0]=>
    string(37) "SHOW FULL COLUMNS FROM wp_wfblocks7"
    [1]=>
    float(0.0006999969482421875)
    [2]=>
    string(223) "require('wp-blog-header.php'), require_once('wp-load.php'), require_once('wp-config.php'), require_once('wp-settings.php'), include_once('/plugins/wordfence/wordfence.php'), wordfence::install_actions, wfBlock::lockoutForIP"
    [3]=>
    float(1681369112.71132)
    [4]=>
    array(0) {
    }
  }
  [4]=>
  array(5) {
    [0]=>
    string(144) "SELECT * FROM wp_wfblocks7 WHERE IP = '\0\0\0\0\0\0\0\0\0\0