we have xml_sitemap 7.x-2.0-rc1 and drupal 7.23 core and it is putting unpublished nodes in the xml site map. What can we do?
Excluding the node manually, isn't really the long term solution. The actual problem resides with the module. There is currently a patch that claims to handle this issue and that's the best place to start.
See this: https://www.drupal.org/node/2266933