VULNERABILITY INTELLIGENCE
CVE-2026-9061
CVSS score3.5 LOW
EPSS probability0.14%
CISA KEVNot currently listed
Published2026-06-13
Last modified2026-07-21
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Description
The Store Locator WordPress plugin before 1.6.9 does not sanitize and escape store logo metadata before storing it and outputting it on the Store Locator WordPress plugin before 1.6.9 admin page, allowing high-privileged users such as administrators to perform Stored Cross-Site Scripting attacks even when the `unfiltered_html` capability is disallowed (e.g. in a multisite network).
Weakness classification
- 134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-79