WordPress security by component
Store Locator WordPress
Plugin description
Store Locator WordPress is a WordPress component with 9 published CVE records in this archive. The latest tracked vulnerability was published Jun 13, 2026; the highest CVE/CNA score is 9.8.
Plugin slug:
store-locatorLatest vulnerability
CVE-2026-9062: Store Locator WordPress: A security weakness
Store Locator WordPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is < 1.6.9.
| Safe version |
|
||
|---|---|---|---|
| Jun 13, 2026 |
CVE-2026-9062
Store Locator WordPress: A security weakness
Store Locator WordPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation. The published affected range is < 1.6.9.
|
1.6.9 |
CVE3.4
NVDPending
|
| Jun 13, 2026 |
CVE-2026-9061
Store Locator WordPress: Cross-site scripting
Store Locator WordPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is < 1.6.9.
|
1.6.9 |
CVE3.5
NVDPending
|
| Jun 10, 2026 |
CVE-2026-9060
Store Locator WordPress: Cross-site scripting
Store Locator WordPress is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is < 1.6.6.
|
1.6.6 |
CVE3.5
NVDPending
|
| Jan 24, 2025 |
CVE-2025-23422
Store Locator: Filesystem traversal
Store Locator is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE7.5
NVDPending
|
| Dec 20, 2024 |
CVE-2024-12571
Store Locator for WordPress with Google Maps – LotsOfLocales: Filesystem traversal
Store Locator for WordPress with Google Maps – LotsOfLocales is affected by filesystem traversal. The vulnerable path is reachable without authentication. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE9.8
NVDPending
|
| Sep 04, 2023 |
CVE-2023-4151
Store Locator: Cross-site scripting
Store Locator is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE6.1
NVD6.1
|
| May 24, 2023 |
CVE-2022-47446
Store Locator: Cross-site request forgery
Store Locator is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE5.4
NVD8.8
|
| Jan 23, 2023 |
CVE-2022-4832
Store Locator: Cross-site scripting
Store Locator is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.
|
See mitigation notes |
CVE5.4
NVD5.4
|
| Oct 16, 2017 |
CVE-2014-8621
Store Locator: SQL injection
Store Locator is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.
|
See mitigation notes |
CVE9.8
NVD9.8
|