CVE-2025-58939
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk3th percentile - higher than 3% of all known CVEs
Summary
The Super Store Finder plugin for WordPress (versions up to 7.5) is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can trick a logged-in user into performing unwanted actions.
Risk Assessment
Unauthorized operations may be performed in the context of a logged-in user, potentially leading to configuration or data changes.
Recommendation
Update the Super Store Finder plugin to a version newer than 7.5 or disable it.
Other vulnerabilities in Super Store Finder
See all- CVE-2026-108541Medium
A vulnerability was found in highwarden Super Store Finder up to version 3.8. An unknown function in /products/superstorefinder/index.php is affected, and manipulation of the lat/lng arguments leads to SQL injection. Remote exploitation is possible, and the exploit has been publicly disclosed. Upgrading to version 3.9 addresses the issue.
- CVE-2026-81768High
An unauthenticated Cross Site Scripting (XSS) vulnerability in Super Store Finder versions up to and including 7.10.
Original NVD description (English source)
Cross-Site Request Forgery (CSRF) vulnerability in highwarden Super Store Finder superstorefinder-wp allows Cross Site Request Forgery.This issue affects Super Store Finder: from n/a through <= 7.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS