Vulnerabilities

TI-2021-06582 CVE-2021-24290 · GHSA-m467-x355-47w9

Store Locator Plus <= 5.5.15 - Unauthenticated Stored Cross-Site Scripting (XSS)

LOW 29

There are several endpoints in the Store Locator Plus for WordPress plugin through 5.5.15 that could allow unauthenticated attackers the ability to inject malicious JavaScript into pages.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00826 Published 2021-05-17 No fix listed CWE-79

TI-2021-06581 CVE-2021-24289 · GHSA-m38j-h682-h2cp

Store Locator Plus <= 5.5.14 - Authenticated Privilege Escalation

MEDIUM 40

There is functionality in the Store Locator Plus for WordPress plugin through 5.5.14 that made it possible for authenticated users to update their user meta data to become an administrator on any site using the plugin.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01149 Published 2021-05-17 No fix listed CWE-269

Vulnerabilities

Filters

Store Locator Plus <= 5.5.15 - Unauthenticated Stored Cross-Site Scripting (XSS)

Store Locator Plus <= 5.5.14 - Authenticated Privilege Escalation