Plugin security history

Store Locator WordPress Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 9 vulnerability records associated with Store Locator WordPress, published between 2022 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

9Total records

0Critical

2High

7Medium

0Low

0Informational

9Patched records

0Currently marked unpatched

2022-09-28First disclosure

2026-06-11Latest disclosure

9 of 9CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2022	2	2 records
2023	3	3 records
2025	3	3 records
2026	1	1 records

Severity Breakdown

Severity	Records	Share
High	2	22.2%
Medium	7	77.8%

Vulnerability-Type Breakdown

Cross-Site Scripting

4 records44.4%

First: 2022. Latest: 2026.

SQL Injection

2 records22.2%

First: 2025. Latest: 2025.

CSRF

1 record11.1%

First: 2022. Latest: 2022.

Path Traversal

1 record11.1%

First: 2023. Latest: 2023.

Arbitrary File Upload

1 record11.1%

First: 2025. Latest: 2025.

Patch Status

Patched: 9
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

1.6.6
1.6.3
1.5.2
1.5.3
1.4.15
1.4.13
1.4.10
1.4.9
1.4.6

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`[*, 1.6.6)`	Store Locator WordPress < 1.6.6 - Authenticated (Administrator+) Stored Cross-Site Scripting	June 11, 2026	1.6.6	Medium
`*-1.6.2`	Store Locator WordPress <= 1.6.2 - Authenticated (Contributor+) SQL Injection	December 14, 2025	1.6.3	Medium
`*-1.5.1`	Store Locator WordPress <= 1.5.1 - Authenticated (Administrator+) SQL Injection	June 5, 2025	1.5.2	Medium
`*-1.5.2`	Store Locator WordPress <= 1.5.2 - Authenticated (Admin+) Arbitrary File Upload	June 5, 2025	1.5.3	High
`*-1.4.14`	Store Locator WordPress <= 1.4.14 - Authenticated(Administrator+) Directory Traversal to Arbitrary File Deletion	December 26, 2023	1.4.15	Medium
`*-1.4.12`	Store Locator WordPress <= 1.4.12 - Reflected Cross-Site Scripting via 'asl-nounce'	August 10, 2023	1.4.13	Medium
`*-1.4.9`	Store Locator WordPress <= 1.4.9 - Authenticated (Editor+) Stored Cross-Site Scripting via 'category_name', 'description', 'description_2' parameters	March 20, 2023	1.4.10	Medium
`*-1.4.8`	Store Locator WordPress <= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	December 24, 2022	1.4.9	Medium
`*-1.4.5`	Store Locator WordPress <= 1.4.5 - Cross-Site Request Forgery to Cross-Site Scripting	September 28, 2022	1.4.6	High

Selected source records

Latest Records

MediumCVE-2026-9060

Store Locator WordPress < 1.6.6 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published: June 11, 2026

Affected versions: [*, 1.6.6)
Patched versions: 1.6.6

Original Wordfence record

MediumCVE-2025-67516

Store Locator WordPress <= 1.6.2 - Authenticated (Contributor+) SQL Injection

Published: December 14, 2025

Affected versions: *-1.6.2
Patched versions: 1.6.3

Original Wordfence record

HighCVE-2025-49329

Store Locator WordPress <= 1.5.2 - Authenticated (Admin+) Arbitrary File Upload

Published: June 5, 2025

Affected versions: *-1.5.2
Patched versions: 1.5.3

Original Wordfence record

MediumCVE-2025-49328

Store Locator WordPress <= 1.5.1 - Authenticated (Administrator+) SQL Injection

Published: June 5, 2025

Affected versions: *-1.5.1
Patched versions: 1.5.2

Original Wordfence record

MediumCVE-2023-50885

Store Locator WordPress <= 1.4.14 - Authenticated(Administrator+) Directory Traversal to Arbitrary File Deletion

Published: December 26, 2023

Affected versions: *-1.4.14
Patched versions: 1.4.15

Original Wordfence record

MediumCVE-2023-4151

Store Locator WordPress <= 1.4.12 - Reflected Cross-Site Scripting via 'asl-nounce'

Published: August 10, 2023

Affected versions: *-1.4.12
Patched versions: 1.4.13

Original Wordfence record

MediumCVE-2023-27618

Store Locator WordPress <= 1.4.9 - Authenticated (Editor+) Stored Cross-Site Scripting via 'category_name', 'description', 'description_2' parameters

Published: March 20, 2023

Affected versions: *-1.4.9
Patched versions: 1.4.10

Original Wordfence record

MediumCVE-2022-4832

Store Locator WordPress <= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published: December 24, 2022

Affected versions: *-1.4.8
Patched versions: 1.4.9

Original Wordfence record

Highest-Severity Records

HighCVE-2022-41615

Store Locator WordPress <= 1.4.5 - Cross-Site Request Forgery to Cross-Site Scripting

Published: September 28, 2022

Affected versions: *-1.4.5
Patched versions: 1.4.6

Original Wordfence record

HighCVE-2025-49329

Store Locator WordPress <= 1.5.2 - Authenticated (Admin+) Arbitrary File Upload

Published: June 5, 2025

Affected versions: *-1.5.2
Patched versions: 1.5.3

Original Wordfence record

MediumCVE-2023-50885

Store Locator WordPress <= 1.4.14 - Authenticated(Administrator+) Directory Traversal to Arbitrary File Deletion

Published: December 26, 2023

Affected versions: *-1.4.14
Patched versions: 1.4.15

Original Wordfence record

MediumCVE-2025-67516

Store Locator WordPress <= 1.6.2 - Authenticated (Contributor+) SQL Injection

Published: December 14, 2025

Affected versions: *-1.6.2
Patched versions: 1.6.3

Original Wordfence record

MediumCVE-2022-4832

Store Locator WordPress <= 1.4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published: December 24, 2022

Affected versions: *-1.4.8
Patched versions: 1.4.9

Original Wordfence record

MediumCVE-2023-4151

Store Locator WordPress <= 1.4.12 - Reflected Cross-Site Scripting via 'asl-nounce'

Published: August 10, 2023

Affected versions: *-1.4.12
Patched versions: 1.4.13

Original Wordfence record

MediumCVE-2025-49328

Store Locator WordPress <= 1.5.1 - Authenticated (Administrator+) SQL Injection

Published: June 5, 2025

Affected versions: *-1.5.1
Patched versions: 1.5.2

Original Wordfence record

MediumCVE-2023-27618

Store Locator WordPress <= 1.4.9 - Authenticated (Editor+) Stored Cross-Site Scripting via 'category_name', 'description', 'description_2' parameters

Published: March 20, 2023

Affected versions: *-1.4.9
Patched versions: 1.4.10

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory