Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-9062

Agile Store Locator < 1.6.9 - Admin+ Arbitrary File Read via Path Traversal

The Store Locator WordPress plugin before 1.6.9 does not validate a parameter before using it in a file path, allowing high-privileged users such as administrators to read arbitrary `.php` files from the server, including configuration files that contain database credentials and authentication keys.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed
Vendors
Store Locator Wordpress Wordpress
Products
Store Locator Wordpress Wordpress
CVE-2026-9061

Agile Store Locator < 1.6.9 - Admin+ Stored XSS via logo_name

The Store Locator WordPress plugin before 1.6.9 does not sanitize and escape store logo metadata before storing it and outputting it on the Store Locator WordPress plugin before 1.6.9 admin page, allowing high-privileged users such as administrators to perform Stored Cross-Site Scripting attacks even when the `unfiltered_html` capability is disallowed (e.g. in a multisite network).

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Store Locator Wordpress Wordpress
Products
Store Locator Wordpress Wordpress
CVE-2026-9060

Agile Store Locator < 1.6.6 - Admin+ Stored XSS via map_style

The Store Locator WordPress plugin before 1.6.6 does not sanitize and escape one of its settings before storing it and outputting it on the Store Locator WordPress plugin before 1.6.6 admin page, allowing high-privileged users such as administrators to perform Stored Cross-Site Scripting attacks even when the `unfiltered_html` capability is disallowed (e.g. in a multisite network where the super admin visits the page).

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed
Vendors
Store Locator Wordpress Wordpress
Products
Store Locator Wordpress Wordpress