Vulnerabilities

TI-2026-47348 CVE-2026-66680 · GHSA-g53f-mwgr-88rp

WordPress Locatoraid Store Locator plugin <= 3.9.72 - SQL Injection vulnerability

MEDIUM 46

Unauthenticated SQL Injection in Locatoraid Store Locator <= 3.9.72 versions.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.004 Published 2026-08-20 No fix listed CWE-89

TI-2025-38462 CVE-2025-62140 · GHSA-j858-6hgc-8rj4

WordPress Locatoraid Store Locator plugin <= 3.9.68 - Cross Site Scripting (XSS) vulnerability

LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in plainware Locatoraid Store Locator locatoraid allows Stored XSS.This issue affects Locatoraid Store Locator: from n/a…

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00207 Published 2025-12-31 No fix listed CWE-79

TI-2025-23688 CVE-2025-32623 · GHSA-qj6q-34pj-64w4

WordPress PlainInventory plugin <= 3.1.9 - CSRF to Stored XSS vulnerability

LOW 31

Cross-Site Request Forgery (CSRF) vulnerability in plainware PlainInventory z-inventory-manager allows Stored XSS.This issue affects PlainInventory: from n/a through <= 3.1.9.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00193 Published 2025-04-09 No fix listed CWE-352

TI-2025-18274 CVE-2025-24557 · GHSA-qwgv-9c86-m892

WordPress PlainInventory plugin <= 3.1.5 - Reflected Cross Site Scripting (XSS) vulnerability

LOW 31

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in plainware PlainInventory z-inventory-manager allows Reflected XSS.This issue affects PlainInventory: from n/a through…

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00334 Published 2025-02-03 No fix listed CWE-79

TI-2024-37252 CVE-2024-56283 · GHSA-q34h-cpvf-cv68

WordPress Locatoraid Store Locator Plugin <= 3.9.50 - PHP Object Injection vulnerability

HIGH 70

Deserialization of Untrusted Data vulnerability in plainware Locatoraid Store Locator locatoraid allows Object Injection.This issue affects Locatoraid Store Locator: from n/a through <= 3.9.50.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00438 Published 2025-01-07 No fix listed CWE-502

TI-2024-37260 CVE-2024-56291 · GHSA-9x5c-5jg6-mcv6

WordPress PlainInventory – Inventory Management Plugin Plugin <= 3.1.6 - PHP Object Injection vulnerability

HIGH 70

Deserialization of Untrusted Data vulnerability in plainware PlainInventory z-inventory-manager allows Object Injection.This issue affects PlainInventory: from n/a through <= 3.1.6.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.00438 Published 2025-01-07 No fix listed CWE-502

TI-2024-08954 CVE-2024-9652 · GHSA-x35f-qgj3-xh3x

Locatoraid Store Locator <= 3.9.47 - Reflected Cross-Site Scripting

LOW 27

The Locatoraid Store Locator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via $_POST keys in all versions up to, and including, 3.9.47 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00386 Published 2024-10-16 No fix listed CWE-79

TI-2024-29629 CVE-2024-44040 · GHSA-pmr5-x36w-pvfp

WordPress ShiftController Employee Shift Scheduling plugin <= 4.9.64 - Cross Site Scripting (XSS) vulnerability

LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in plainware ShiftController Employee Shift Scheduling shiftcontroller allows Stored XSS.This issue affects ShiftControll…

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00275 Published 2024-10-06 No fix listed CWE-79

TI-2024-08754 CVE-2024-9435 · GHSA-v7c7-5c4j-4f68

ShiftController Employee Shift Scheduling <= 4.9.66 - Reflected Cross-Site Scripting

LOW 27

The ShiftController Employee Shift Scheduling plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via URL keys in all versions up to, and including, 4.9.66 due to insufficient input sanitization and outp…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00386 Published 2024-10-04 No fix listed CWE-79

TI-2024-04406 CVE-2024-4733 · GHSA-8chv-cvvp-q439

ShiftController Employee Shift Scheduling <= 4.9.57 - Authenticated (Contributor+) PHP Object Injection

LOW 36

The ShiftController Employee Shift Scheduling plugin is vulnerable to PHP Object Injection via deserialization of untrusted input via the `hc3_session`-cookie in versions up to, and including, 4.9.57.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00588 Published 2024-05-16 No fix listed CWE-502

TI-2024-19927 CVE-2024-30181 · GHSA-qf8g-47rf-49pj

WordPress Locatoraid Store Locator plugin <= 3.9.30 - Cross Site Scripting (XSS) vulnerability

LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plainware Locatoraid Store Locator allows Stored XSS.This issue affects Locatoraid Store Locator: from n/a through 3.9…

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00359 Published 2024-03-27 No fix listed CWE-79

TI-2023-13805 CVE-2023-29425 · GHSA-3xxj-rfjr-w6h5

WordPress ShiftController Employee Shift Scheduling Plugin <= 4.9.23 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in plainware.Com ShiftController Employee Shift Scheduling plugin <= 4.9.23 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00264 Published 2023-11-12 No fix listed CWE-352

TI-2023-04132 CVE-2023-4476 · GHSA-rj34-xxjf-5p6r

Locatoraid Store Locator < 3.9.24 - Reflected XSS

MEDIUM 60

The Locatoraid Store Locator WordPress plugin before 3.9.24 does not sanitise and escape the lpr-search parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used aga…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00486 Published 2023-09-25 Fixed in 3.9.24

TI-2023-15858 CVE-2023-32576 · GHSA-3f5r-vp32-5ghx

WordPress Locatoraid Store Locator Plugin <= 3.9.18 is vulnerable to Cross Site Scripting (XSS)

LOW 29

Auth. (subscriber+) Stored Cross-Site Scripting') vulnerability in Plainware Locatoraid Store Locator plugin <= 3.9.18 versions.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00361 Published 2023-08-25 No fix listed CWE-79

TI-2023-13804 CVE-2023-29424 · GHSA-76j7-5gg4-8fv4

WordPress ShiftController Employee Shift Scheduling Plugin <= 4.9.23 is vulnerable to Cross Site Scripting (XSS)

LOW 31

Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Plainware ShiftController Employee Shift Scheduling plugin <= 4.9.23 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00392 Published 2023-06-26 No fix listed CWE-79

TI-2023-01908 CVE-2023-2031 · GHSA-xxc4-jcf3-x9g7

Locatoraid Store Locator <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

LOW 25

The Locatoraid Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 3.9.14 due to insufficient input sanitization and output esca…

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00488 Published 2023-06-09 No fix listed CWE-79

TI-2023-01861 CVE-2023-1978 · GHSA-5g87-8pvq-89c8

ShiftController Employee Shift Scheduling <= 4.9.25 - Reflected Cross-Site Scripting via Query String

LOW 28

The ShiftController Employee Shift Scheduling plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the query string in versions up to, and including, 4.9.25 due to insufficient input sanitization and…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00433 Published 2023-06-09 No fix listed CWE-79

TI-2023-10985 CVE-2023-25709 · GHSA-4c4f-fw26-8fmg

WordPress Locatoraid Store Locator Plugin <= 3.9.11 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Plainware Locatoraid Store Locator plugin <= 3.9.11 versions.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00248 Published 2023-03-15 No fix listed CWE-352

Vulnerabilities

Filters