String locator

String locator has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2025; all 4 are fixed as of September 2026. Their average CVSS score is 7.2, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 2 high. 2022 was the busiest year with 2 disclosures.

The most common weakness is Deserialization Of Untrusted Data, behind 2 of the records (50%). Other recurring categories include Cross-Site Scripting, Path Traversal.

Every one of the 4 issues recorded for String locator has a vendor fix available, so running the current release closes all known holes.

4 independent researchers contributed these findings, one record each. String locator is installed on roughly 100,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.7.7.

Strategic Overview

Avg CVSSHigh
7.2/ 10
Patch Coverage100%
Open

0

Fixed

4

Get automatic notifications for all String locator vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2024-10936

String Locator <= 2.6.6 - Unauthenticated PHP Object Injection

Read the full analysis

Vulnerability Records

4 records
String locator banner
Latestv2.6.7

String locator

InstaWP

Author

InstaWP

4.6(125)
92/100
Last Updated
2025-01-15 (2y ago)
Active Installs
100,000+
Downloads
1,416,723
Requires WP
4.9+
Requires PHP
0+
Tested up to
WP 6.7.7
Created
2013-08-15 (13y ago)

When working on themes and plugins you often notice a piece of text that appears hardcoded into the files, you need to modify it, but you don’t know what theme or plugin it’s in, and certainly not which individual file to look in. Easily search through your themes, plugins or even WordPress core and be presented with a list of files, the matched text and what line of the file matched your search. You can then quickly make edits directly in your browser by clicking the link from the search results. By default a consistency check is performed when making edits to files, this will look for inconsistencies with braces, brackets and parenthesis that are often accidentally left in. This drastically reduces the risk of breaking your site when making edits, but is in no way an absolute guarantee. Create a replica of your live site a.k.a – WordPress Staging site before testing substitutions.

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C