CVE-2026-9060

Name of the Vulnerable Software and Affected Versions Store Locator WordPress plugin versions prior to 1.6.6

Description The plugin fails to sanitize and escape a specific setting before it is stored and subsequently displayed on the administration page. This allows high-privileged users, such as administrators, to execute Stored Cross-Site Scripting (XSS) attacks. This issue persists even when the unfiltered html capability is disabled, which can impact environments like multisite networks when a super administrator views the page. The vulnerable variable is map style.

Recommendations Update to version 1.6.6 or later. As a temporary workaround, restrict access to the administration page settings involving the map style variable to minimize the risk of exploitation.