Store Locator for WordPress with Google Maps – LotsOfLocales

Store Locator for WordPress with Google Maps – LotsOfLocales has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2014 and 2025; 3 are fixed and 2 remain unpatched as of September 2026. Their average CVSS score is 8.4, and the most serious one scores 9.8 out of 10. Severity breakdown: 3 critical and 1 high.

The most common weakness is PHP Remote File Inclusion, behind 2 of the records (40%). Other recurring categories include SQL Injection, Cross-Site Request Forgery (CSRF).

3 of the records (60%) have a vendor fix, while 2 remain unpatched. The oldest unresolved one dates back to 2024.

4 independent researchers contributed these findings, most of them (2) reported by James Hooker.

Strategic Overview

Avg CVSSHigh

8.4/ 10

Patch Coverage60%

Open

Fixed

Get automatic notifications for all Store Locator for WordPress with Google Maps – LotsOfLocales vulnerabilities before they are exploited.

Most severe open issueCVSS 9.8CVE-2024-12571

Store Locator <= 3.98.10 - Unauthenticated Local File Inclusion

Read the full analysis

Vulnerability Records

5 records


2025-01-16 00:00	Store Locator for WordPress with Google Maps – LotsOfLocales <= 3.98.10 - Unauthenticated Local File Inclusion Store Locator for WordPress… <= 3.98.10	`CVE-2025-23422`	8.1 High	tahu.datar	No
2024-12-19 00:00	Store Locator <= 3.98.10 - Unauthenticated Local File Inclusion Store Locator for WordPress… 3.98.9	`CVE-2024-12571`	9.8 Critical	Jay Nguyen	No
2023-03-15 00:00	Store Locator <= 3.98.7 - Cross-Site Request Forgery to Settings Update Store Locator for WordPress… <= 3.98.7	`CVE-2022-47446`	4.3 Medium	rezaduty	Yes
2015-02-09 00:00	Store Locator < 3.34 - SQL Injection Store Locator for WordPress… < 3.34	`N/A`	9.8 Critical	James Hooker	Yes
2014-11-05 00:00	Store Locator 2.3 - 3.11 - SQL Injection Store Locator for WordPress… < 3.12	`CVE-2014-8621`	9.8 Critical	James Hooker	Yes

Showing 1–5 of 5 reports