CVE-2025-62140
Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in plainware Locatoraid Store Locator locatoraid allows Stored XSS.This issue affects Locatoraid Store Locator: from n/a through <= 3.9.68.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Stored XSS in Locatoraid Store Locator plugin (≤3.9.68) allows authenticated attackers to inject malicious scripts.
The Locatoraid Store Locator plugin for WordPress versions ≤3.9.68 contains a Stored Cross-Site Scripting (XSS) vulnerability due to improper neutralization of user-supplied input during web page generation [1]. This allows an attacker to inject arbitrary HTML and JavaScript into the application's database.
To exploit this vulnerability, an attacker must have at least contributor-level access (or equivalent) and trigger the stored payload by performing an action such as clicking a malicious link or submitting a crafted form [1]. User interaction is required for successful exploitation.
Successful exploitation could lead to execution of malicious scripts when other users (including administrators) visit affected pages. This can result in redirects, display of advertisements, or other HTML payloads, potentially compromising the site's integrity and user trust [1].
The vendor has been notified; users are strongly advised to update the plugin to a patched version. If immediate update is not possible, consult your hosting provider or web developer for workarounds [1].
AI Insight generated on May 19, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected products
2- Range: <=3.9.68
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
1News mentions
0No linked articles in our index yet.