55 matches found
CVE-2026-9062
The Store Locator WordPress plugin (specifically the Agile Store Locator plugin) versions prior to 1.6.9 are vulnerable to an Arbitrary File Read via Path Traversal . The root cause is the insufficient validation of a parameter used in a file path. This flaw allows high-privileged users, such as ...
EUVD-2026-36644
The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary .php files from the server, including configuration files that contain database credentials and authentication keys...
EUVD-2026-36643
The Store Locator WordPress plugin before 1.6.9 does not sanitize and escape store logo metadata before storing it and outputting it on the Store Locator WordPress plugin before 1.6.9 admin page, allowing high-privileged users such as administrators to perform Stored Cross-Site Scripting attacks...
CVE-2026-9062 Agile Store Locator < 1.6.9 - Admin+ Arbitrary File Read via Path Traversal
The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary .php files from the server, including configuration files that contain database credentials and authentication keys...
PT-2026-49079
Name of the Vulnerable Software and Affected Versions Store Locator WordPress plugin versions prior to 1.6.9 Description Insufficient sanitization and escaping of store logo metadata before it is stored and displayed on the admin page allows high-privileged users, such as administrators, to execu...
CVE-2026-9060
The Store Locator WordPress plugin before 1.6.6 does not sanitize and escape one of its settings before storing it and outputting it on the Store Locator WordPress plugin before 1.6.6 admin page, allowing high-privileged users such as administrators to perform Stored Cross-Site Scripting attacks...
WordPress Agile Store Locator plugin < 1.6.6 - Admin+ Stored XSS via map_style vulnerability
Admin+ Stored XSS via mapstyle vulnerability discovered by Luca Jungnickel in WordPress Plugin Store Locator WordPress versions 1.6.6...
CVE-2026-9060
The Store Locator WordPress plugin (versions before 1.6.6 ) is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitize and escape one of the plugin's settings before it is stored and subsequently rendered on the admin page. Specifically, the ma...
CVE-2026-9060 Agile Store Locator < 1.6.6 - Admin+ Stored XSS via map_style
The Store Locator WordPress plugin before 1.6.6 does not sanitize and escape one of its settings before storing it and outputting it on the Store Locator WordPress plugin before 1.6.6 admin page, allowing high-privileged users such as administrators to perform Stored Cross-Site Scripting attacks...
PT-2026-48388
The Store Locator WordPress plugin before 1.6.6 does not sanitize and escape one of its settings before storing it and outputting it on the Store Locator WordPress plugin before 1.6.6 admin page, allowing high-privileged users such as administrators to perform Stored Cross-Site Scripting attacks...
CVE-2026-2580
The CVE-2026-2580 entry concerns the WP Maps – Store Locator, Google Maps, OpenStreetMap, Mapbox, Listing, Directory & Filters WordPress plugin (up to v4.9.1). The root cause is insufficient escaping and insufficient preparation of an SQL query, enabling time-based SQL Injection via the ‘orderby’...
CVE-2023-4151
The Store Locator WordPress plugin before 1.4.13 does not sanitise and escape an invalid nonce before outputting it back in an AJAX response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2023-25709
Cross-Site Request Forgery CSRF vulnerability in Plainware Locatoraid Store Locator plugin = 3.9.11 versions...
CVE-2025-67516
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Agile Logix Store Locator WordPress agile-store-locator allows Blind SQL Injection.This issue affects Store Locator WordPress: from n/a through = 1.6.2...
CVE-2025-67516 WordPress Store Locator WordPress plugin <= 1.6.2 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Agile Logix Store Locator WordPress agile-store-locator allows Blind SQL Injection.This issue affects Store Locator WordPress: from n/a through = 1.6.2...
CVE-2025-10754
The DocoDoco Store Locator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the zip upload functionality in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with Editor-level access and above, to uploa...
EUVD-2014-8458
Malware in sbrugna...
EUVD-2023-29619
Malicious code in bioql PyPI...