Store Locator Plus® for WordPress

Store Locator Plus® for WordPress has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2015 and 2024; 4 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 6.3, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high. 2021 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 2 of the records (40%). Other recurring categories include Exposure Of Sensitive Information To An Unauthorized Actor, Improper Access Control.

4 of the records (80%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2024.

4 independent researchers contributed these findings, most of them (2) reported by Chloe Chamberland.

Strategic Overview

Avg CVSSMedium

6.3/ 10

Patch Coverage80%

Open

Fixed

Get automatic notifications for all Store Locator Plus® for WordPress vulnerabilities before they are exploited.

Most severe open issueCVSS 5.3CVE-2024-43258

Store Locator Plus <= 2311.17.01 - Unauthenticated Sensitive Information Exposure

Read the full analysis

Vulnerability Records

5 records


2024-08-12 00:00	Store Locator Plus <= 2311.17.01 - Unauthenticated Sensitive Information Exposure Store Locator Plus® for WordPress <= 2311.17.01	`CVE-2024-43258`	5.3 Medium	Peng Zhou	No
2021-04-26 00:00	Store Locator Plus <= 5.5.15 - Authenticated Privilege Escalation Store Locator Plus® for WordPress <= 5.5.15	`CVE-2021-24289`	8.8 High	Chloe Chamberland	Yes
2021-04-26 00:00	Store Locator Plus <= 5.12.3 - Unauthenticated Stored Cross-Site Scripting Store Locator Plus® for WordPress <= 5.12.3	`CVE-2021-24290`	6.1 Medium	Chloe Chamberland	Yes
2016-07-01 00:00	Store Locator Plus <= 4.5.11 - Cross-Site Scripting Store Locator Plus® for WordPress < 4.5.11	`N/A`	6.1 Medium	Yorick Koster,	Yes
2015-01-17 00:00	Store Locator Plus < 4.2.27 - Email Injection Store Locator Plus® for WordPress < 4.2.27	`N/A`	5.3 Medium	Kacper Szurek	Yes

Showing 1–5 of 5 reports