Stored Cross-Site Scripting in Locatoraid Store Locator Plugin for WordPress

CVE-2023-2031

What is CVE-2023-2031?

The Locatoraid Store Locator plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability due to inadequate input validation and output escaping of user-supplied attributes in plugin shortcodes. Authenticated attackers with contributor-level permissions can exploit this flaw to inject malicious scripts into web pages, which executes when users access the affected pages. This poses a significant risk of exposing users to harmful scripts, highlighting the importance of keeping the plugin updated and implementing proper security measures.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References