EUVD-2026-36643
GHSA-q5mp-4wmh-7f39
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Administrator authentication (PR:H) and victim page-view (UI:R) are mandatory; XSS impact is scoped to admin UI with no availability loss.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Lifecycle Timeline
4DescriptionCVE.org
The Store Locator WordPress plugin before 1.6.9 does not sanitize and escape store logo metadata before storing it and outputting it on the Store Locator WordPress plugin before 1.6.9 admin page, allowing high-privileged users such as administrators to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (e.g. in a multisite network).
AnalysisAI
Stored XSS in the Store Locator WordPress plugin before 1.6.9 allows high-privileged users (administrators) to inject persistent malicious scripts via unsanitized store logo metadata, which executes when the admin page is rendered in another user's browser. The vulnerability is especially significant in WordPress multisite networks because it bypasses the unfiltered_html capability restriction - a control specifically intended to prevent administrators from injecting raw HTML and scripts. A public POC is documented by WPScan; no active exploitation is confirmed (absent from CISA KEV), and EPSS of 0.03% indicates low current exploitation probability.
Technical ContextAI
CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) describes the root cause: the plugin fails to sanitize or escape user-supplied store logo metadata at both the input (persistence) and output (rendering) layers. WordPress provides a built-in unfiltered_html capability to gate whether users may insert raw HTML and script content; this plugin's missing sanitization renders that gate ineffective. The flaw is classified as stored (persistent) XSS because the payload survives in the database and fires on every subsequent page load. CPE cpe:2.3:a:unknown:store_locator_wordpress:*:*:*:*:*:*:*:* covers all versions of the plugin prior to 1.6.9. The vulnerability was discovered and reported by WPScan, a specialized WordPress security intelligence platform.
RemediationAI
Upgrade the Store Locator WordPress plugin to version 1.6.9 or later, which contains the vendor-released patch correcting the missing sanitization and escaping of store logo metadata. The WPScan advisory at https://wpscan.com/vulnerability/a9f8656a-548a-4353-b157-d07f23c3bc26/ provides authoritative upgrade guidance. If an immediate upgrade is operationally blocked, temporarily restrict the store logo metadata editing capability to only the most trusted administrator accounts and audit existing store entries for injected script content (look for script tags or JavaScript event handler attributes in logo fields). In WordPress multisite environments where this flaw specifically undermines the unfiltered_html restriction, the workaround of restricting admin access may not be feasible and patching should be treated as urgent. There are no known side effects to the 1.6.9 upgrade beyond the security fix.
More in Store Locator Wordpress
View allStored Cross-Site Scripting in Store Locator WordPress plugin before 1.6.6 allows administrator-level users to inject pe
Path traversal in the Store Locator WordPress plugin before version 1.6.9 enables authenticated administrators to read a
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today