What is the CVSS score of CVE-2026-3361?

CVE-2026-3361 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WP Store Locator CVE-2026-3361

EUVD-2026-25172 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-23 Wordfence

GHSA-p6p5-j5xg-r643

GHSA-vqqc-7rwf-3j3j

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 23, 2026 - 07:08 vuln.today

EUVD ID Assigned

Apr 23, 2026 - 04:00 euvd

EUVD-2026-25172

Analysis Generated

Apr 23, 2026 - 04:00 vuln.today

CVE Published

Apr 23, 2026 - 03:26 nvd

MEDIUM 6.4

DescriptionCVE.org

The WP Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpsl_address' post meta value in versions up to, and including, 2.2.261 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page and opens an injected map marker info window.

AnalysisAI

Stored Cross-Site Scripting in WP Store Locator plugin for WordPress up to version 2.2.261 allows authenticated contributors and above to inject arbitrary JavaScript via the 'wpsl_address' post meta field, executing in browsers of any user who views an affected map marker info window. The vulnerability requires contributor-level access or higher and does not require user interaction beyond normal page browsing, resulting in session hijacking, credential theft, or malware distribution with CVSS 6.4 impact spanning confidentiality and integrity across security boundaries.

Technical ContextAI

WP Store Locator is a WordPress plugin that manages store location information, including address data stored as post meta values. The vulnerability stems from insufficient input sanitization of the 'wpsl_address' post meta field and inadequate output escaping when rendering map marker information windows. The plugin fails to properly sanitize user-supplied data at the point of storage and does not escape output when the address is displayed in JavaScript-enabled map contexts, allowing malicious scripts to execute with the privileges of any user viewing the marker. This is a classic stored XSS vulnerability (CWE-79) where the attack payload persists in the WordPress database and executes in the DOM whenever the map is accessed.

RemediationAI

Update WP Store Locator to a version released after 2.2.261 that includes sanitization and escaping fixes (exact patched version number not specified in provided data; verify against WordPress plugin repository or Wordfence advisory for the first patched release). The WordPress plugin repository changeset 3482539 indicates a fix has been committed; check the repository directly for the release version. In the interim, restrict contributor-level role assignments to highly trusted users, audit existing contributors for unauthorized account access, review post meta data for suspicious content in the 'wpsl_address' field using database queries, and consider temporarily disabling the WP Store Locator plugin if it is not actively used and cannot be updated immediately. Additionally, implement WordPress security hardening by enabling two-factor authentication for all contributor accounts and monitoring post meta modifications through a security plugin or database audit logging.