Locatoraid Store Locator < 3.9.15 - Contributor+ Stored Cross-Site Scripting

2023-04-1700:00:00

wpscan.com

cross-site scripting

stored

plugin

shortcode

authentication

contributor-level permissions

0.001 Low

EPSS

Percentile

45.3%

JSON

The plugin does not properly sanitize input and escape output in its shortcode(s), leading to stored cross-site scripting vulnerabilities for authenticated users with contributor-level permissions or higher.

CPENameOperatorVersion
locatoraidlt3.9.15

CPE	Name	Operator	Version
	locatoraid	lt	3.9.15

References

www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/locatoraid/locatoraid-store-locator-3914-authenticated-contributor-stored-cross-site-scripting-via-shortcode

0.001 Low

EPSS

Percentile

45.3%

JSON

Related for WPVDB-ID:1E90BAF5-1F11-4ABE-9595-8065548F7B00