CVE-2025-15677

The GeoDirectory WordPress plugin before 2.8.110 does not sanitise and escape a place-category setting before outputting it back in an admin page, allowing high-privilege users such as editors and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...

CVE-2026-9060

The Store Locator WordPress plugin before 1.6.6 does not sanitize and escape one of its settings before storing it and outputting it on the Store Locator WordPress plugin before 1.6.6 admin page, allowing high-privileged users such as administrators to perform Stored Cross-Site Scripting attacks...

CVE-2026-9060

The Store Locator WordPress plugin (versions before 1.6.6 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitize and escape one of the plugin's settings before it is stored and subsequently output on the admin page. Specifically, the map_style se...

PT-2026-48388

Name of the Vulnerable Software and Affected Versions Store Locator WordPress plugin versions prior to 1.6.6 Description The plugin fails to sanitize and escape a specific setting before it is stored and subsequently displayed on the administration page. This allows high-privileged users, such as...

CVE-2021-24619

The Per page add to head WordPress plugin through 1.4.4 does not properly sanitise one of its setting, allowing malicious HTML to be inserted by high privilege users even when the unfilteredhtml capability is disallowed, which could lead to Cross-Site Scripting issues...

CVE-2021-24534

The PhoneTrack Meu Site Manager WordPress plugin through 0.1 does not sanitise or escape its "phpid" setting before outputting it back in an attribute in the page, leading to a stored Cross-Site Scripting issue...