Store Locator WordPress EUVD-2026-36643

Exploitation requires the attacker to hold an existing administrator-level WordPress account (CVSS PR:H) - this cannot be bypassed and is the primary limiting factor. The attack further requires a second victim administrator to visit the plugin's admin page where the malicious store logo metadata is rendered (CVSS UI:R). The vulnerability is specifically triggered via the store logo metadata field in the Store Locator plugin's admin interface; no other entry point is identified. The most impactful exploitation context is a WordPress multisite network where unfiltered_html has been explicitly disallowed for site administrators, as this flaw circumvents that hardening measure. On standard single-site installations where administrators already possess unfiltered_html, no meaningful security boundary is bypassed. Non-default limiting factors: requires pre-existing admin authentication; requires victim admin to browse to the affected admin page after payload is stored.

The CVSS 3.1 base score of 3.5 (Low) correctly reflects the constrained exploitation path: it requires an already-authenticated administrator (PR:H) and a second privileged user to visit the affected page (UI:R). EPSS at 0.03% (9th percentile) confirms very low observed exploitation probability. SSVC corroborates: Automatable:No (manual interaction chain required), Technical Impact:Partial (limited scope to admin UI). The vulnerability is not listed in CISA KEV, so no confirmed in-the-wild exploitation. However, a public POC exists via WPScan, which lowers the exploitation bar for actors with existing admin access. The primary real-world risk elevation occurs specifically in WordPress multisite deployments where unfiltered_html has been explicitly revoked from administrators - in that hardened configuration, this flaw undermines an intentional security boundary. For standard single-site WordPress installations where admins already possess unfiltered_html, the incremental risk is negligible. Overall this is a low-priority issue for most environments, with a slightly elevated priority for multisite operators who rely on capability restrictions.

An attacker who controls or has compromised an administrator account injects a JavaScript payload (e.g., a cookie-stealing script) into the store logo metadata field of any store entry within the plugin. When a second administrator subsequently opens the Store Locator admin page, the stored payload executes silently in their browser session, potentially harvesting their WordPress admin session cookie or performing authenticated actions on their behalf. A public POC documenting this scenario is available in the WPScan vulnerability database.