Store Locator Le Vulnerabilities

The Store Locator Plus® for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2311.17.01. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.

CVSS:

5.3

Affected:

up to 2311.17.01

Fix:

No patched version reported

Disclosed:

Aug 12, 2024

CVE-2024-43258 on NVD →

There is functionality in the Store Locator Plus for WordPress plugin through 5.5.15 that made it possible for authenticated users to update their user meta data to become an administrator on any site using the plugin.

CVSS:

8.8

Affected:

up to 5.5.15

Fixed in:

5.7

Disclosed:

Apr 26, 2021

CVE-2021-24289 on NVD →

There are several endpoints in the Store Locator Plus for WordPress plugin through 5.12.3 that could allow unauthenticated attackers the ability to inject malicious JavaScript into pages.

CVSS:

6.1

Affected:

up to 5.12.3

Fixed in:

5.13.8

Disclosed:

Apr 26, 2021

CVE-2021-24290 on NVD →

The Store Locator Plus plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘start’ parameter in versions up to, and including, 4.5.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that ex...

CVSS:

6.1

Affected:

up to 4.5.11

Fixed in:

4.5.12

Disclosed:

Jul 1, 2016

The Store Locator Plus plugin for WordPress is vulnerable to Email Injection in versions before 4.2.27. This is due to nonce leakage. This makes it possible for attackers to send spam emails from a fake address.

CVSS:

5.3

Affected:

up to 4.2.27

Fixed in:

4.2.27

Disclosed:

Jan 17, 2015