Wpexperts Wp Multi Store Locator vulnerabilities

3 vulnerabilities

Known vulnerabilities in Wpexperts Wp Multi Store Locator, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

7.1CVE-2025-24680wordpresswp-multi-store-locator+2
EPSS score
0.26%
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPExperts.io WP Multistore Locator wp-multi-store-locator allows Reflected XSS.This issue affects WP Multistore Locator: from n/a through <= 2.4.7.6.4CVE-2024-12475wordpresswp-multi-store-locator+2
EPSS score
0.32%
The WP Multi Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.6.4CVE-2023-0152unknownwp multi store locator+2
EPSS score
0.44%
The WP Multi Store Locator WordPress plugin through 2.4 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks