Security Alert Summary
The WP Store Locator plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the wpsl_address post meta value. Authenticated users with contributor-level access and above can inject scripts that execute when a user opens an injected map marker info window.
CVE Details
- CVE ID: CVE-2026-3361
- Affected component: WP Store Locator plugin for WordPress (the
wpsl_addresspost meta value) - Affected versions: versions up to, and including, 2.2.261
- Published: April 23, 2026 at 4:16:18 AM UTC
- Last modified: April 23, 2026 at 2:28:55 PM UTC
- CVSS v3.1: Base Score 6.4, MEDIUM — Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Authentication / Privileges / User interaction: Privileges Required: LOW (authenticated user with contributor-level access or higher); User Interaction: NONE; Scope: CHANGED
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- Weakness (CWE): CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
The vulnerability is a stored cross-site scripting (XSS) issue caused by insufficient input sanitization and output escaping of the wpsl_address post meta value. An authenticated attacker with contributor-level access or higher can save specially crafted data into the wpsl_address field. That data is later rendered into pages containing store markers without adequate escaping, allowing arbitrary script execution when a user opens the injected map marker info window.
This is a persistent (stored) XSS scenario: the malicious script is stored in the site database and executes in the context of any user who views the affected marker info window. The description does not name specific functions or REST endpoints beyond the wpsl_address post meta and the map marker info window rendering, so analysis and mitigation should focus on sanitizing input and escaping output where that post meta is used.
How This Could Impact Your Website
Consider a site where the owner manages locations and multiple contributors or contractors add and edit store entries. A contributor could add a store address that contains a malicious script. When an editor, administrator, or regular site visitor opens the marker info window for that location, the script could run in their browser. Practical consequences include exposure of user-visible data on pages, or use of the user session to display fraudulent content or perform actions allowed in the browser context.
Realistic impacts include exposure of internal user email addresses visible on pages, an increased risk of targeted phishing or social engineering against staff or site users, and reputational harm from pages displaying unexpected content. If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor accounts that can create or edit store entries.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and themes from the site.
- Monitor site activity and logs for unusual changes to post meta or unexpected content in store entries.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
