PT-2021-15829 · WordPress · Store Locator Plus

Chloe Chamberland · Published 2021-05-17 · Updated 2021-05-24 · CVE-2021-24290

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Store Locator Plus for WordPress plugin versions prior to 5.5.16

Description The issue allows unauthenticated attackers to inject malicious JavaScript into pages through several endpoints in the plugin.

Recommendations For versions prior to 5.5.16, update to version 5.5.16 or later to resolve the issue.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24290

Affected Products

Store Locator Plus

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-24290 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24290 · Vendor Advisory
• https://wpscan.com/vulnerability/dc368484-f2fe-4c76-ba3d-e00e7f633719 · Note
• https://wordfence.com/blog/2021/04/severe-unpatched-vulnerabilities-leads-to-closure-of-store-locator-plus-plugin · Note