Cross-site Scripting Vulnerability in Locatoraid Store Locator by Plainware
CVE-2024-30181

5.9MEDIUM

Key Information:

Vendor

Plainware

Status
Locatoraid Store Locator
Vendor
CVE Published:
27 March 2024

What is CVE-2024-30181?

The Locatoraid Store Locator plugin developed by Plainware is susceptible to a Cross-site Scripting (XSS) vulnerability caused by improper neutralization of user input during web page generation. This flaw allows attackers to inject malicious scripts that can be executed when a victim accesses the compromised web page. The vulnerability affects versions of Locatoraid Store Locator before 3.9.30, potentially leading to the storage of malicious payloads and exploitation in environments where user-generated content is displayed. It is crucial for users to upgrade to the latest version to safeguard against potential attacks.

Affected Version(s)

Locatoraid Store Locator <= 3.9.30

References

https://patchstack.com/database/vulnerability/locatoraid/...
vdb-entry

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

.