CVE-2026-9061

UNKNOWN 0.0

Agile Store Locator < 1.6.9 - Admin+ Stored XSS via logo_name

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The Store Locator WordPress plugin before 1.6.9 does not sanitize and escape store logo metadata before storing it and outputting it on the Store Locator WordPress plugin before 1.6.9 admin page, allowing high-privileged users such as administrators to perform Stored Cross-Site Scripting attacks even when the `unfiltered_html` capability is disallowed (e.g. in a multisite network).

Vendor	unknown
Product	store locator wordpress
Published	Jun 13, 2026

Stay Ahead of the Next One

Get instant alerts for unknown store locator wordpress

Be the first to know when new unknown vulnerabilities affecting unknown store locator wordpress are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Unknown / Store Locator WordPress

0 < 1.6.9

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wpscan.com: https://wpscan.com/vulnerability/a9f8656a-548a-4353-b157-d07f23c3bc26/

Credits

TRAN THE LONG WPScan