The risk of sending money to a xpub generated address Suppose the owner of xpub share the xpub to others, and someone send some money to a xpub generated address.

If the owner of xprv does not know the path used to generate that new address, is that means money has lost forever and will always live in the UXTO.
That depends on the derivation path which was used for the xpub and derived address, to which the funds were sent to.

The xprv "owner" can scan "standard" derivation paths to determine whether these keys where used (funds were sent to these), by parsing the blockchain transaction history. If a standard BIP44 key derivation path schema was used, it can scan the following addresses by incrementing the index. 

Let's say, the owner shared the xpub key M/44'/0'/0'/0. It can then search the following derivation paths for example to determine which one received funds.


M/44'/0'/0'/0/0
M/44'/0'/0'/0/1
M/44'/0'/0'/0/2
M/44'/0'/0'/0/3
...
If a significant number of consequent keys are unused, the wallet may decide to stop the scan.


If arbitrary derivation paths were used which are unknown to the "owner" instead of standard ones, the space to scan can be very large.