CVE-2026-9060 - Agile Store Locator < 1.6.6 - Admin+ Stored XSS via map_style

Back Back to CVE browser

LOW

Agile Store Locator < 1.6.6 - Admin+ Stored XSS via map_style

Published Jun 10, 2026

3.5

LOW

CVSS 3.1

EPSS 0.24%

Description

The Store Locator WordPress plugin before 1.6.6 does not sanitize and escape one of its settings before storing it and outputting it on the Store Locator WordPress plugin before 1.6.6 admin page, allowing high-privileged users such as administrators to perform Stored Cross-Site Scripting attacks even when the `unfiltered_html` capability is disallowed (e.g. in a multisite network where the super admin visits the page).

Affected products

Vendor n/a Product Store Locator WordPress Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <1.6.6

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Store Locator WordPress

unaffected

Version	Status	Constraints
0	affected	<1.6.6

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (2)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-35987
Advisory
https://wpscan.com/vulnerability/1ed01413-09a2-4a2e-be5b-375f2a327d0d/
exploitvdb-entrytechnical-description

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-35987		Advisory
https://wpscan.com/vulnerability/1ed01413-09a2-4a2e-be5b-375f2a327d0d/		exploitvdb-entrytechnical-description