PT-2026-49079 · WordPress · Store Locator

Published 2026-06-13 · Updated 2026-06-13 · CVE-2026-9061

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Store Locator WordPress plugin versions prior to 1.6.9

Description Insufficient sanitization and escaping of store logo metadata before it is stored and displayed on the admin page allows high-privileged users, such as administrators, to execute Stored Cross-Site Scripting (XSS) attacks. This occurs even in environments where the unfiltered html capability is disabled, such as in multisite networks.

Recommendations Update the plugin to version 1.6.9 or later.

Exploit

Related Identifiers

CVE-2026-9061

Affected Products

Store Locator

References · 3

• 🔥 https://wpscan.com/vulnerability/a9f8656a-548a-4353-b157-d07f23c3bc26 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-9061 · Security Note
• https://twitter.com/CVEnew/status/2065840871421952448 · Twitter Post