The WP Store Locator plugin contains a stored cross‑site scripting vulnerability that allows authenticated users with contributor‑level access or higher to insert arbitrary JavaScript into the wpsl_address post meta field. The injected script is rendered when a user views a page containing the affected store entry or opens a map marker info window, providing the attacker with the ability to deface content, hijack sessions, or delivery malware to end users.

WordPress sites running the WP Store Locator plugin version 2.2.261 or earlier are affected. The plugin is developed by tijmensmit and the vulnerable code resides in the wpsl_address post meta handler.

The vulnerability carries a CVSS score of 6.4, indicating moderate severity, and an EPSS score of less than 1%, so exploitation is considered unlikely but not impossible. It is not listed in the CISA KEV catalog. Attackers must be authenticated with at least contributor privileges and must be able to create or edit store entries; once the malicious content is stored, any visitor who loads the affected page or map marker will execute the injected script.