CVE-2026-105078: WordPress WP Store Locator plugin <= 3.0.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Store Locator WP Store Locator wp-store-locator allows Stored XSS.This issue affects WP Store Locator: from n/a through 3.0.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/wp-store-locatorto a version that resolves this vulnerability.Fixed in 3.1.0
Event History
Frequently Asked Questions
What access and interaction are required for exploitation?
The CVSS vector indicates network access, low privileges, and user interaction are required. An attacker cannot exploit this anonymously according to the provided vector.
What is the expected security impact if exploitation succeeds?
The issue is rated medium severity with low impacts to confidentiality, integrity, and availability. The CVSS vector also indicates scope can change, meaning the impact may extend beyond the initially affected security authority.