3.4
Faible
CVE-2026-9062 The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing…
Description
The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary `.php` files from the server, including configuration files that contain database credentials and authentication keys.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Store Locator WordPress 1.6 | premières → < 1.6.9 | 1.6.9 |
Autres CVE de Store Locator WordPress
Les 5 CVE de Store Locator WordPress →
CVE-2026-9061
The Store Locator WordPress plugin before 1.6.9 does not sanitize and escape store logo metadata before storing it and…
3.5
Faible
CVE-2026-9060
The Store Locator WordPress plugin before 1.6.6 does not sanitize and escape one of its settings before storing it and…
3.5
Faible
CVE-2023-4151
The Store Locator WordPress plugin before 1.4.13 does not sanitise and escape an invalid nonce before outputting it back…
6.1
Moyenne
CVE-2022-4832
The Store Locator WordPress plugin before 1.4.9 does not validate and escape some of its shortcode attributes before…
5.4
Moyenne