The Store Locator WordPress plugin before 1.6.9 stores the value of the store logo metadata without proper sanitization or escaping. On the admin interface the unsanitized value is rendered directly, which allows an attacker who has administrative privileges (or any role with equivalent capability) to inject arbitrary JavaScript that will execute in the context of the admin page. This stored XSS can lead to credential theft, defacement, or execution of arbitrary code with the privileges of the logged‑in administrator. The vulnerability is a classic cross‑site scripting flaw (CWE‑79).

The vulnerability affects all installations of the Store Locator WordPress plugin with a version earlier than 1.6.9. Any WordPress site that has installed this plugin within that version range is vulnerable, regardless of other plugins or themes.

The exploit requires that the attacker first gain access to an account with administrative privileges, as the flaw is exercised only in the admin interface. The EPSS score of < 1% indicates a very low likelihood of successful exploitation in the wild. While the vulnerability is not listed in CISA’s KEV catalog, the CVSS score of 3.5 signifies a low severity vulnerability. Even so, malicious scripts would still execute with the privileges of the logged‑in administrator, so the overall risk is considered low but remedial action is still recommended.