CVE-2025-10754

Name of the Vulnerable Software and Affected Versions DocoDoco Store Locator plugin for WordPress versions up to and including 1.0.1

Description The DocoDoco Store Locator plugin for WordPress has a flaw allowing unauthorized file uploads. This occurs because of a lack of proper file type checking when uploading zip files. Attackers with Editor-level access or higher can upload any file type to the server, potentially leading to remote code execution.

Recommendations Update the DocoDoco Store Locator plugin to a version newer than 1.0.1.