CVE-2026-105078

MediumCVSS 6.5

Published: 08/10/2026(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Summary

Stored XSS vulnerability in WP Store Locator (up to 3.0.3) due to improper input neutralization.

Risk Assessment

Attackers can inject malicious scripts that execute in other users' browsers, potentially leading to data theft or session hijacking.

Recommendation

Update the plugin to the latest version.

Other vulnerabilities in WP Store Locator

CVE-2026-94681Medium
Unauthenticated Denial of Service (DoS) vulnerability in WP Store Locator before version 3.0.0.

Original NVD description (English source)

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Store Locator WP Store Locator wp-store-locator allows Stored XSS.This issue affects WP Store Locator: from n/a through 3.0.3.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS