← back to popular plugins
wordfence / plugin · wp-store-locator
WP Store Locator
wp-store-locator
total installs
50,000
total vulns
2
critical
0
high
1
medium
1
low
0
latest vuln
—
patched
2
unpatched
0
avg time to patch
—
vulnerabilities
(2)
WP Store Locator <= 2.2.261 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'wpsl_address' Post Meta
medium
✓ patched
cve id
CVE-2026-3361 ↗
cvss score
6.4
cwe
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
published
Apr 22, 2026
The WP Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpsl_address' post meta value in versions up to, and including, 2.2.261 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page and opens an injected map marker info window.
Store Locator <= 2.2.260 - Authenticated (Contributor+) PHP Object Injection
high
✓ patched
cve id
CVE-2025-52737 ↗
cvss score
7.5
cwe
CWE-502: Deserialization of Untrusted Data
published
Jul 31, 2025
The Store Locator plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.2.260 via deserialization of untrusted input. This makes it possible for authenticated attackers, with contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.