CVE-2026-9060

Vulnerability

The Store Locator WordPress plugin before version 1.6.6 fails to properly sanitize and escape a setting before it is stored and later outputted on the plugin's admin page. This vulnerability exists in versions prior to 1.6.6.

Exploitation

An attacker with high privileges, such as an administrator, can exploit this vulnerability by injecting malicious scripts into the map_style setting. This attack can be successful even when the unfiltered_html capability is disallowed, such as when a super administrator visits the page in a multisite network [1].

Impact

Successful exploitation allows a high-privileged user to execute arbitrary JavaScript in the context of other administrators or users who view the affected admin page. This can lead to Stored Cross-Site Scripting (XSS) attacks, potentially compromising user sessions or performing actions on behalf of the user.

Mitigation

The vulnerability is fixed in version 1.6.6 of the Store Locator WordPress plugin. Users should update to this version or later to mitigate the risk. No other mitigation details are available in the provided references.