EUVD-2026-68790
GHSA-2h3x-r24r-45h9
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated reflected XSS with browser scope change; availability assessed as N since XSS does not cause service disruption to the vulnerable component.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Super Store Finder <= 7.10 versions.
AnalysisAI
Cross-site scripting in the Super Store Finder WordPress plugin (versions <= 7.10) allows unauthenticated remote attackers to inject malicious client-side scripts that execute in the security context of victim users' browsers. The CVSS Scope Change metric (S:C) confirms the attack crosses from the plugin's server-side context into the victim's browser environment, enabling session hijacking, credential harvesting, or malicious redirects against site visitors or administrators who interact with the affected input. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No authentication is required - CVSS PR:N confirms any unauthenticated remote user can deliver the XSS payload to the server. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | With a CVSS 3.1 base score of 7.1 (High) and an AV:N/AC:L/PR:N profile, this XSS is straightforward to reach: no authentication, no elevated complexity, and no special configuration prerequisites. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the Super Store Finder plugin to a version beyond 7.10 via the WordPress plugin dashboard or the WordPress.org plugin repository. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Audit all WordPress installations to identify active deployments of Super Store Finder plugin and record current versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Super Store Finder
View allSuper Store Finder v3.6 was discovered to contain multiple SQL injection vulnerabilities in the store locator component
A hard coded password in Super Store Finder v3.6 allows attackers to access the administration panel. Rated critical sev
Super Store Finder 3.7 and below is vulnerable to authenticated Arbitrary PHP Code Injection that could lead to Remote C
Super Store Finder v3.6 and below was discovered to contain a SQL injection vulnerability via the Search parameter at /a
A vulnerability was found in Super Store Finder 3.6. Rated critical severity (CVSS 9.8), this vulnerability is remotely
Unauthenticated SQL injection in the Super Store Finder WordPress plugin (versions 7.8 and earlier, vendor 'highwarden'/
The Super Store Finder plugin for WordPress is vulnerable to SQL Injection via the ‘ssf_wp_user_name’ parameter in all v
The Super Store Finder plugin for WordPress is vulnerable to unauthenticated arbitrary email creation and relay in versi
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today