Wp Store Locator
Monthly
Stored Cross-Site Scripting in WP Store Locator plugin for WordPress up to version 2.2.261 allows authenticated contributors and above to inject arbitrary JavaScript via the 'wpsl_address' post meta field, executing in browsers of any user who views an affected map marker info window. The vulnerability requires contributor-level access or higher and does not require user interaction beyond normal page browsing, resulting in session hijacking, credential theft, or malware distribution with CVSS 6.4 impact spanning confidentiality and integrity across security boundaries.
Stored Cross-Site Scripting in WP Store Locator plugin for WordPress up to version 2.2.261 allows authenticated contributors and above to inject arbitrary JavaScript via the 'wpsl_address' post meta field, executing in browsers of any user who views an affected map marker info window. The vulnerability requires contributor-level access or higher and does not require user interaction beyond normal page browsing, resulting in session hijacking, credential theft, or malware distribution with CVSS 6.4 impact spanning confidentiality and integrity across security boundaries.