Store Locator WordPress < 1.4.13 - Cross-Site Scripting

The Store Locator WordPress plugin before 1.4.13 does not sanitise and escape an invalid nonce before outputting it back in an AJAX response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. id: CVE-2023-4151 info: name: Store Locator...

WordPress Agile Store Locator plugin < 1.6.9 - Admin+ Stored XSS via logo_name vulnerability

Admin+ Stored XSS via logoname vulnerability discovered by TRAN THE LONG in WordPress Plugin Store Locator WordPress versions 1.6.9...

WordPress Agile Store Locator plugin < 1.6.9 - Admin+ Arbitrary File Read via Path Traversal vulnerability

Admin+ Arbitrary File Read via Path Traversal vulnerability discovered by Abisheik M in WordPress Plugin Store Locator WordPress versions 1.6.9...