Location Manager <= 2.3.38 - Unauthenticated SQL Injection via 'latitude' and 'longitude' REST API Parameters
high
The Location Manager plugin for WordPress is vulnerable to generic SQL Injection via 'latitude' and 'longitude' REST API Parameters in all versions up to, and including, 2.3.38 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possibl...
- CVSS:
- 7.5
(Wordfence)
- Affected:
- up to 2.3.38
- Fixed in:
- 2.3.39
- Disclosed:
- Sep 17, 2026
CVE-2026-85705 on NVD →
Location Manager < 2.1.0.10 - SQL Injection
critical
In the Location Manager WordPress plugin before 2.1.0.10, the AJAX action gd_popular_location_list did not properly sanitise or validate some of its POST parameters, which are then used in a SQL statement, leading to unauthenticated SQL Injection issues.
- CVSS:
- 9.8
(Wordfence)
- Affected:
- up to 2.1.0.10
- Fixed in:
- 2.1.0.10
- Disclosed:
- Jun 4, 2021
CVE-2021-24361 on NVD →
Protect your WordPress site
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free
← Back to the vulnerability database