CVE-2024-13657

The Store Locator Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'storelocatorwidget' shortcode in all versions up to, and including, 2025r1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...

CVE-2024-13657

creationtimestamp| type| source ---|---|--- 2025-02-19 08:16:33+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lijdk2delf2g 2025-02-19 08:41:02+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/4784 2025-02-19 15:39:52+00:00| seen|...

CVE-2024-13657

CVE-2024-13657 concerns the Store Locator Widget plugin for WordPress. It is vulnerable to a Stored Cross-Site Scripting (XSS) via the plugin’s ‘storelocatorwidget’ shortcode in all versions up to and including 20200131, due to insufficient input sanitization and output escaping on user-supplied ...

CVE-2024-13657 Store Locator Widget <= 2025r1 - Authenticated (Contributor+) Stored Cross-Site Scripting

The Store Locator Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'storelocatorwidget' shortcode in all versions up to, and including, 2025r1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible fo...