Super Store Finder vulnerabilities

A vulnerability was found in highwarden Super Store Finder up to version 3.8. An unknown function in /products/superstorefinder/index.php is affected, and manipulation of the lat/lng arguments leads to SQL injection. Remote exploitation is possible, and the exploit has been publicly disclosed. Upgrading to version 3.9 addresses the issue.

An unauthenticated Cross Site Scripting (XSS) vulnerability in Super Store Finder versions up to and including 7.10.

The Super Store Finder plugin for WordPress (versions up to 7.5) is vulnerable to Cross-Site Request Forgery (CSRF). An attacker can trick a logged-in user into performing unwanted actions.