5.4
Medium
CVE-2022-4832 The Store Locator WordPress plugin before 1.4.9 does not validate and escape some of its shortcode attributes before…
Description
The Store Locator WordPress plugin before 1.4.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Store Locator WordPress 1.4 | earliest → < 1.4.9 | 1.4.9 |
Other CVEs of Store Locator WordPress
The 5 CVEs of Store Locator WordPress →
CVE-2026-9062
The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing…
3.4
Low
CVE-2026-9061
The Store Locator WordPress plugin before 1.6.9 does not sanitize and escape store logo metadata before storing it and…
3.5
Low
CVE-2026-9060
The Store Locator WordPress plugin before 1.6.6 does not sanitize and escape one of its settings before storing it and…
3.5
Low
CVE-2023-4151
The Store Locator WordPress plugin before 1.4.13 does not sanitise and escape an invalid nonce before outputting it back…
6.1
Medium