CVE-2026-115204

The AZEXO Store Locator WordPress plugin (versions through 1.4 ) is vulnerable to an arbitrary file write due to a lack of capability or nonce checks on AJAX actions. The plugin fails to sanitize a request header used to construct a file path, which allows an authenticated user, such as a subscri...