WP Store Locator EUVD-2026-94947

Exploitation requires an authenticated WordPress account with at least low-level privileges (PR:L) sufficient to write into a WP Store Locator field that is stored and later rendered without sanitization; it is not exploitable by fully unauthenticated visitors. Delivery of the payload is passive-but-dependent on victim interaction (UI:R): a second user, typically an administrator or editor, must view the page where the stored script is rendered for the attack to fire. Limiting factors therefore include the need for a valid low-privilege login, the requirement that the plugin be installed and active at version ≤3.0.3, and reliance on a privileged victim actually viewing the attacker-controlled content; these substantially narrow realistic exploitation compared to an unauthenticated flaw.

This is a moderate-severity stored XSS (CWE-79) in the WP Store Locator WordPress plugin, carrying a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L). The vector indicates network-reachable, low-complexity exploitation that nonetheless requires an authenticated low-privilege account (PR:L) and victim interaction (UI:R), with a scope change (S:C) reflecting script execution in a different security context (the victim's browser/admin session). Exploitation status: no public exploit identified at time of analysis - there is no EPSS score, no CISA KEV listing, and no POC indicator in the provided data, so there is no evidence of active or widespread exploitation. No SSVC decision data was supplied. In practical terms this is a typical Patchstack-reported WordPress plugin stored XSS: a real but not urgent issue, best characterized as a lower-tier priority driven by the authentication requirement and the need for a victim to view the malicious content, rather than a high-real-risk flaw. Missing signals (EPSS, KEV, POC, SSVC) are absences, not contradictions; the CVSS network vector is consistent with a stored XSS payload delivered over the web and later rendered to another user.

An authenticated low-privilege user (for example a contributor or an operator with access to store-location fields) submits input containing a malicious script payload into a WP Store Locator field that is stored without proper neutralization. When an administrator or other user later views the affected page in the WordPress dashboard or front end, the stored script executes in their browser session, potentially enabling session/cookie theft or actions performed as the victim. No public exploit code is identified at this time.