Vulnerabilities

TI-2024-28911 CVE-2024-43258 · GHSA-2v3g-4chr-x8h3

WordPress Store Locator Plus® for WordPress plugin <= 2311.17.01 - Sensitive Data Exposure vulnerability

LOW 33

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Store Locator Plus.This issue affects Store Locator Plus: from n/a through 2311.17.01.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00389 Published 2024-08-26 No fix listed CWE-200

TI-2021-06582 CVE-2021-24290 · GHSA-m467-x355-47w9

Store Locator Plus <= 5.5.15 - Unauthenticated Stored Cross-Site Scripting (XSS)

LOW 29

There are several endpoints in the Store Locator Plus for WordPress plugin through 5.5.15 that could allow unauthenticated attackers the ability to inject malicious JavaScript into pages.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00826 Published 2021-05-17 No fix listed CWE-79

TI-2021-06581 CVE-2021-24289 · GHSA-m38j-h682-h2cp

Store Locator Plus <= 5.5.14 - Authenticated Privilege Escalation

MEDIUM 40

There is functionality in the Store Locator Plus for WordPress plugin through 5.5.14 that made it possible for authenticated users to update their user meta data to become an administrator on any site using the plugin.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01149 Published 2021-05-17 No fix listed CWE-269

Vulnerabilities

Filters

WordPress Store Locator Plus® for WordPress plugin <= 2311.17.01 - Sensitive Data Exposure vulnerability

Store Locator Plus <= 5.5.15 - Unauthenticated Stored Cross-Site Scripting (XSS)

Store Locator Plus <= 5.5.14 - Authenticated Privilege Escalation