EUVD-2026-35987
GHSA-q278-422p-x5h7
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Primary rating from Vendor (WPScan) · only source for this CVE.
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
The Store Locator WordPress plugin before 1.6.6 does not sanitize and escape one of its settings before storing it and outputting it on the Store Locator WordPress plugin before 1.6.6 admin page, allowing high-privileged users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (e.g. in a multisite network where the super admin visits the page).
AnalysisAI
Stored Cross-Site Scripting in Store Locator WordPress plugin before 1.6.6 allows administrator-level users to inject persistent malicious scripts into the plugin's admin settings page, with execution triggered when any privileged user visits the page. Critically, this bypass works even when WordPress's unfiltered_html capability is restricted - a control commonly enforced in multisite networks - meaning a subsite admin could target visiting super admins. A publicly available exploit exists via WPScan, though no active exploitation has been confirmed by CISA KEV. CVSS rates this 3.5 (Low), but multisite deployments face materially higher practical risk.
Technical ContextAI
The vulnerability is a Stored XSS flaw (CWE-79: Improper Neutralization of Input During Web Page Generation) in the Store Locator WordPress plugin (CPE: cpe:2.3:a:unknown:store_locator_wordpress:*:*:*:*:*:*:*:*, all versions before 1.6.6). The root cause is the plugin's failure to sanitize and escape a settings field before persisting it to the database and rendering it back on the admin page - the standard sink/source XSS pattern. What elevates this beyond a typical admin-context XSS is that the flaw operates independently of WordPress's built-in unfiltered_html capability gate, a permission flag multisite networks routinely restrict to limit HTML injection by non-super-admin administrators. The plugin does not route this input through WordPress's escaping pipeline (e.g., esc_attr() or esc_html() on output, or sanitize_text_field() on save), making the native WordPress access control an ineffective compensating control here.
RemediationAI
Update the Store Locator WordPress plugin to version 1.6.6 or later, which contains the vendor-released patch resolving the unsanitized settings input. The fix is confirmed available per the WPScan advisory at https://wpscan.com/vulnerability/1ed01413-09a2-4a2e-be5b-375f2a327d0d/. In WordPress admin, navigate to Plugins > Installed Plugins > Store Locator > Update to apply. If immediate patching is blocked, the most effective compensating control in multisite deployments is to audit and minimize which users hold site-admin roles on subsites, reducing the pool of potential attackers. Restricting access to the Store Locator settings page via role-based access control plugins (e.g., restricting the relevant admin menu capability) may limit exposure but requires plugin-specific configuration and should not be treated as a permanent fix. Relying solely on disabling unfiltered_html is explicitly insufficient - this vulnerability bypasses that control by design.
More in Store Locator Wordpress
View allStored XSS in the Store Locator WordPress plugin before 1.6.9 allows high-privileged users (administrators) to inject pe
Path traversal in the Store Locator WordPress plugin before version 1.6.9 enables authenticated administrators to read a
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today