WordPress Plugin Vulnerabilities

Store Locator WordPress < 1.4.10 - Editor+ Stored XSS

Description

The plugin does not sanitise and escape some parameters (such as category_name, description, description_2 etc), which could allow users with a role as low as Editor to perform Cross-Site Scripting attacks

Affects Plugins

Plugin icon
agile-store-locator
Fixed in 1.4.10

References

CVE
CVE-2023-27618

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
3.5 (low)

Miscellaneous

Original Researcher
Abdi Pranata
Verified
No
WPVDB ID
1e061893-5e86-4f10-8e92-72dd901530ce

Timeline

Publicly Published
2023-03-20 (about 3 years ago)
Added
2023-06-22 (about 2 years ago)
Last Updated
2023-06-22 (about 2 years ago)

Other

Published
Title
Published
2026-01-13
Title
KenthaRadio <= 2.2.0 - Reflected Cross-Site Scripting
Published
2025-03-24
Title
issuuPress <= 1.3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Published
2025-04-02
Title
User Submitted Posts < 20250327 - Authenticated (Admin+) Stored Cross-Site Scripting
Published
2023-05-04
Title
Cart Lift < 3.1.6 - Reflected XSS
Published
2025-04-17
Title
AdminQuickbar < 1.9.2 - Reflected Cross-Site Scripting