String locator
String locator has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2025; all 4 are fixed as of September 2026. Their average CVSS score is 7.2, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high. 2022 was the busiest year with 2 disclosures.
The most common weakness is Deserialization Of Untrusted Data, behind 2 of the records (50%). Other recurring categories include Cross-Site Scripting, Path Traversal.
Every one of the 4 issues recorded for String locator has a vendor fix available, so running the current release closes all known holes.
4 independent researchers contributed these findings, one record each. String locator is installed on roughly 100,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.7.7.
CVE-2024-10936String Locator <= 2.6.6 - Unauthenticated PHP Object Injection
Read the full analysisVulnerability Records

String locator
Author
InstaWP
When working on themes and plugins you often notice a piece of text that appears hardcoded into the files, you need to modify it, but you don’t know what theme or plugin it’s in, and certainly not which individual file to look in. Easily search through your themes, plugins or even WordPress core and be presented with a list of files, the matched text and what line of the file matched your search. You can then quickly make edits directly in your browser by clicking the link from the search results. By default a consistency check is performed when making edits to files, this will look for inconsistencies with braces, brackets and parenthesis that are often accidentally left in. This drastically reduces the risk of breaking your site when making edits, but is in no way an absolute guarantee. Create a replica of your live site a.k.a – WordPress Staging site before testing substitutions.
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C