Cross‑Site Request Forgery in the Store Locator Widget plugin allows malicious data to be stored in the site’s database. When that data is rendered, the embedded JavaScript executes in the context of any visitor to the affected content, delivering attacker‑controlled code to all users who view the page. Based on the description, it is inferred that the attacker must forge a request on behalf of an authenticated user to inject the malicious data.

The vulnerability applies to Store Locator Widget by Store Locator Widgets for all WordPress installations running version 2025r2 or earlier. No narrower version scope is defined by the vendor.

The CVSS base score is 7.1, indicating a high‑severity condition, while the EPSS score is below 1% and the issue is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack requires a logged‑in user to click a forged request, making it limited to social engineering or compromised credentials; once a malicious script is stored it can persistently affect every visitor who loads the compromised content.