Store Locator WordPress CVE-2026-9060

Exploitation requires the attacker to already possess WordPress administrator-level credentials for the target site (confirmed by CVSS PR:H). The Store Locator WordPress plugin must be installed, active, and running a version prior to 1.6.6. A second privileged user (administrator or super admin) must visit the admin page where the malicious payload is rendered (CVSS UI:R). The vulnerability is especially impactful in WordPress multisite networks where the unfiltered_html capability is restricted, because this restriction - normally a compensating control - does not prevent this exploit. Exploitation is entirely blocked for unauthenticated users and users without administrator-level access; low-privileged roles (editor, author, subscriber) cannot access the settings page and cannot trigger this flaw. Standard single-site installs where only a single trusted admin exists face near-zero practical risk from this specific XSS, as the attacker and victim would need to be different individuals.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N) scores 3.5 (Low), reflecting two significant exploitation constraints: high privilege required (PR:H - administrator-level access to the plugin settings) and required user interaction (UI:R - a second privileged user must visit the admin page). Scope is unchanged (S:U), and impact is limited to low confidentiality and integrity effects in isolation. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified from this dataset. The CVE is not listed in the CISA KEV catalog, indicating no confirmed mass exploitation at time of analysis. However, a publicly available exploit via WPScan lowers the attacker skill threshold considerably. The raw CVSS score underweights the multisite privilege-escalation vector: an attacker with subsite-admin credentials - a relatively common role in large WordPress networks - can target super admins who visit the page, effectively achieving upward privilege impact not reflected in the S:U scope designation. For single-site installs, risk aligns with the low CVSS score. For multisite networks, this should be treated as moderate priority.

An attacker with WordPress administrator credentials navigates to the Store Locator plugin's settings page and saves a malicious JavaScript payload (e.g., a cookie-stealing script) into the vulnerable, unescaped settings field. When a super admin or other privileged user subsequently visits the admin page where the setting is rendered, the stored payload executes silently in their browser session. In a multisite environment, this allows a subsite admin to harvest the super admin's session token, enabling full network takeover. A publicly available exploit via WPScan means this attack pattern is accessible to low-skill adversaries who have already obtained admin credentials through phishing or credential stuffing.