The vulnerability allows attackers to inject malicious JavaScript that is permanently stored by the WP Store Locator plugin. When a site visitor loads a page using the plugin, the malicious script runs in the context of the site, potentially stealing session cookies, defacing content, or redirecting users to phishing sites. This is a typical stored XSS weakness driven by improper input neutralization (CWE‑79).

The issue affects the WordPress WP Store Locator plugin for all versions up through and including 3.0.3. Hosts running this plugin on any WordPress installation are potentially vulnerable until the plugin is upgraded to a version that removes the stored XSS path.

The CVSS score of 6.5 indicates a moderate risk; the EPSS score is currently unavailable, and the vulnerability is not listed in CISA’s KEV catalog. Attackers could exploit the flaw via the plugin’s web forms, submitting crafted data that is later rendered without proper escaping. The impact is confined to browsers that load the compromised pages, and the flaw does not provide a local privilege escalation or direct remote code execution on the server.