Stored Cross-Site Scripting in Locatoraid Store Locator Plugin for WordPress

CVE-2023-2031

What is CVE-2023-2031?

The Locatoraid Store Locator plugin for WordPress suffers from a Stored Cross-Site Scripting vulnerability due to inadequate input validation and output escaping of user-supplied attributes in plugin shortcodes. Authenticated attackers with contributor-level permissions can exploit this flaw to inject malicious scripts into web pages, which executes when users access the affected pages. This poses a significant risk of exposing users to harmful scripts, highlighting the importance of keeping the plugin updated and implementing proper security measures.

References