The Store Locator WordPress plugin prior to version 1.6.9 stores the value of the store logo metadata without proper sanitization or escaping. On the admin interface the unsanitized value is rendered directly, which allows an attacker who has administrative privileges (or any role with equivalent capability) to inject arbitrary JavaScript that will execute in the context of the admin page. This stored XSS can lead to credential theft, defacement, or execution of arbitrary code with the privileges of the logged‑in administrator. The vulnerability is a classic cross‑site scripting flaw (CWE‑79).

The vulnerability affects all installations of the Store Locator WordPress plugin with a version earlier than 1.6.9. Any WordPress site that has installed this plugin within that version range is vulnerable, regardless of other plugins or themes.

The exploit requires that the attacker first gain access to an account with administrative privileges, as the flaw is exercised only in the admin interface. While the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog, the impact of successful exploitation is high for the targeted site, because the malicious script runs with the administrator’s session. The CVSS score is unspecified, but given the stored nature of the flaw and the privileged scope, the overall risk is considered high for sites that have not applied the fix.