3.5
Faible
CVE-2026-9060 The Store Locator WordPress plugin before 1.6.6 does not sanitize and escape one of its settings before storing it and…
Description
The Store Locator WordPress plugin before 1.6.6 does not sanitize and escape one of its settings before storing it and outputting it on the Store Locator WordPress plugin before 1.6.6 admin page, allowing high-privileged users such as administrators to perform Stored Cross-Site Scripting attacks even when the `unfiltered_html` capability is disallowed (e.g. in a multisite network where the super admin visits the page).
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Store Locator WordPress 1.6 | premières → < 1.6.6 | 1.6.6 |
Autres CVE de Store Locator WordPress
Les 5 CVE de Store Locator WordPress →
CVE-2026-9062
The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing…
3.4
Faible
CVE-2026-9061
The Store Locator WordPress plugin before 1.6.9 does not sanitize and escape store logo metadata before storing it and…
3.5
Faible
CVE-2023-4151
The Store Locator WordPress plugin before 1.4.13 does not sanitise and escape an invalid nonce before outputting it back…
6.1
Moyenne
CVE-2022-4832
The Store Locator WordPress plugin before 1.4.9 does not validate and escape some of its shortcode attributes before…
5.4
Moyenne