Store Locator Wordpress
Monthly
Path traversal in the Store Locator WordPress plugin before version 1.6.9 enables authenticated administrators to read arbitrary PHP files from the server filesystem, including wp-config.php, which contains database credentials and WordPress secret keys. The vulnerability stems from an unvalidated parameter passed directly into a file path, allowing traversal sequences to escape the intended directory. A publicly available proof-of-concept exists per WPScan reporting, though EPSS sits at 0.04% (12th percentile) and no KEV listing exists, indicating low observed exploitation activity despite the public PoC.
Stored XSS in the Store Locator WordPress plugin before 1.6.9 allows high-privileged users (administrators) to inject persistent malicious scripts via unsanitized store logo metadata, which executes when the admin page is rendered in another user's browser. The vulnerability is especially significant in WordPress multisite networks because it bypasses the `unfiltered_html` capability restriction - a control specifically intended to prevent administrators from injecting raw HTML and scripts. A public POC is documented by WPScan; no active exploitation is confirmed (absent from CISA KEV), and EPSS of 0.03% indicates low current exploitation probability.
Stored Cross-Site Scripting in Store Locator WordPress plugin before 1.6.6 allows administrator-level users to inject persistent malicious scripts into the plugin's admin settings page, with execution triggered when any privileged user visits the page. Critically, this bypass works even when WordPress's `unfiltered_html` capability is restricted - a control commonly enforced in multisite networks - meaning a subsite admin could target visiting super admins. A publicly available exploit exists via WPScan, though no active exploitation has been confirmed by CISA KEV. CVSS rates this 3.5 (Low), but multisite deployments face materially higher practical risk.
Path traversal in the Store Locator WordPress plugin before version 1.6.9 enables authenticated administrators to read arbitrary PHP files from the server filesystem, including wp-config.php, which contains database credentials and WordPress secret keys. The vulnerability stems from an unvalidated parameter passed directly into a file path, allowing traversal sequences to escape the intended directory. A publicly available proof-of-concept exists per WPScan reporting, though EPSS sits at 0.04% (12th percentile) and no KEV listing exists, indicating low observed exploitation activity despite the public PoC.
Stored XSS in the Store Locator WordPress plugin before 1.6.9 allows high-privileged users (administrators) to inject persistent malicious scripts via unsanitized store logo metadata, which executes when the admin page is rendered in another user's browser. The vulnerability is especially significant in WordPress multisite networks because it bypasses the `unfiltered_html` capability restriction - a control specifically intended to prevent administrators from injecting raw HTML and scripts. A public POC is documented by WPScan; no active exploitation is confirmed (absent from CISA KEV), and EPSS of 0.03% indicates low current exploitation probability.
Stored Cross-Site Scripting in Store Locator WordPress plugin before 1.6.6 allows administrator-level users to inject persistent malicious scripts into the plugin's admin settings page, with execution triggered when any privileged user visits the page. Critically, this bypass works even when WordPress's `unfiltered_html` capability is restricted - a control commonly enforced in multisite networks - meaning a subsite admin could target visiting super admins. A publicly available exploit exists via WPScan, though no active exploitation has been confirmed by CISA KEV. CVSS rates this 3.5 (Low), but multisite deployments face materially higher practical risk.