Plugin security history

Locatoraid Store Locator Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 8 vulnerability records associated with Locatoraid Store Locator, published between 2023 and 2025.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

8Total records

1Critical

0High

7Medium

0Low

0Informational

7Patched records

1Currently marked unpatched

2023-02-14First disclosure

2025-12-31Latest disclosure

8 of 8CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2023	4	4 records
2024	2	2 records
2025	2	2 records

Severity Breakdown

Severity	Records	Share
Critical	1	12.5%
Medium	7	87.5%

Vulnerability-Type Breakdown

Cross-Site Scripting

6 records75%

First: 2023. Latest: 2025.

CSRF

1 record12.5%

First: 2023. Latest: 2023.

Other

1 record12.5%

First: 2025. Latest: 2025.

Patch Status

Patched: 7
Currently marked unpatched: 1
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

3.9.51
3.9.48
3.9.31
3.9.24
3.9.19
3.9.15
3.9.12

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`*-3.9.65`	Locatoraid Store Locator <= 3.9.65 - Authenticated (Administrator+) Stored Cross-Site Scripting	December 31, 2025	Not supplied	Medium
`*-3.9.50`	Locatoraid Store Locator <= 3.9.50 - Unauthenticated PHP Object Injection	January 3, 2025	3.9.51	Critical
`*-3.9.47`	Locatoraid Store Locator <= 3.9.47 - Reflected Cross-Site Scripting	October 15, 2024	3.9.48	Medium
`*-3.9.30`	Locatoraid Store Locator <= 3.9.30 - Authenticated (Administrator+) Stored Cross-Site Scripting	March 25, 2024	3.9.31	Medium
`*-3.9.23`	Locatoraid Store Locator <= 3.9.23 - Reflected Cross-Site Scripting	August 28, 2023	3.9.24	Medium
`*-3.9.18`	Locatoraid Store Locator <= 3.9.18 - Authenticated (Subscriber+) Stored Cross-Site Scripting	May 11, 2023	3.9.19	Medium
`*-3.9.14`	Locatoraid Store Locator <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode	April 17, 2023	3.9.15	Medium
`*-3.9.11`	Locatoraid Store Locator <= 3.9.11 - Cross Site Request Forgery in grab	February 14, 2023	3.9.12	Medium

Selected source records

Latest Records

MediumCVE-2025-62140

Locatoraid Store Locator <= 3.9.65 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published: December 31, 2025

Affected versions: *-3.9.65
Patched versions: Not supplied

Original Wordfence record

CriticalCVE-2024-56283

Locatoraid Store Locator <= 3.9.50 - Unauthenticated PHP Object Injection

Published: January 3, 2025

Affected versions: *-3.9.50
Patched versions: 3.9.51

Original Wordfence record

MediumCVE-2024-9652

Locatoraid Store Locator <= 3.9.47 - Reflected Cross-Site Scripting

Published: October 15, 2024

Affected versions: *-3.9.47
Patched versions: 3.9.48

Original Wordfence record

MediumCVE-2024-30181

Locatoraid Store Locator <= 3.9.30 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published: March 25, 2024

Affected versions: *-3.9.30
Patched versions: 3.9.31

Original Wordfence record

MediumCVE-2023-4476

Locatoraid Store Locator <= 3.9.23 - Reflected Cross-Site Scripting

Published: August 28, 2023

Affected versions: *-3.9.23
Patched versions: 3.9.24

Original Wordfence record

MediumCVE-2023-32576

Locatoraid Store Locator <= 3.9.18 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Published: May 11, 2023

Affected versions: *-3.9.18
Patched versions: 3.9.19

Original Wordfence record

MediumCVE-2023-2031

Locatoraid Store Locator <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published: April 17, 2023

Affected versions: *-3.9.14
Patched versions: 3.9.15

Original Wordfence record

MediumCVE-2023-25709

Locatoraid Store Locator <= 3.9.11 - Cross Site Request Forgery in grab

Published: February 14, 2023

Affected versions: *-3.9.11
Patched versions: 3.9.12

Original Wordfence record

Highest-Severity Records

CriticalCVE-2024-56283

Locatoraid Store Locator <= 3.9.50 - Unauthenticated PHP Object Injection

Published: January 3, 2025

Affected versions: *-3.9.50
Patched versions: 3.9.51

Original Wordfence record

MediumCVE-2023-32576

Locatoraid Store Locator <= 3.9.18 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Published: May 11, 2023

Affected versions: *-3.9.18
Patched versions: 3.9.19

Original Wordfence record

MediumCVE-2023-4476

Locatoraid Store Locator <= 3.9.23 - Reflected Cross-Site Scripting

Published: August 28, 2023

Affected versions: *-3.9.23
Patched versions: 3.9.24

Original Wordfence record

MediumCVE-2024-9652

Locatoraid Store Locator <= 3.9.47 - Reflected Cross-Site Scripting

Published: October 15, 2024

Affected versions: *-3.9.47
Patched versions: 3.9.48

Original Wordfence record

MediumCVE-2024-30181

Locatoraid Store Locator <= 3.9.30 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published: March 25, 2024

Affected versions: *-3.9.30
Patched versions: 3.9.31

Original Wordfence record

MediumCVE-2023-2031

Locatoraid Store Locator <= 3.9.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Published: April 17, 2023

Affected versions: *-3.9.14
Patched versions: 3.9.15

Original Wordfence record

MediumCVE-2025-62140

Locatoraid Store Locator <= 3.9.65 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published: December 31, 2025

Affected versions: *-3.9.65
Patched versions: Not supplied

Original Wordfence record

MediumCVE-2023-25709

Locatoraid Store Locator <= 3.9.11 - Cross Site Request Forgery in grab

Published: February 14, 2023

Affected versions: *-3.9.11
Patched versions: 3.9.12

Original Wordfence record

Currently Marked Unpatched Records

MediumCVE-2025-62140

Locatoraid Store Locator <= 3.9.65 - Authenticated (Administrator+) Stored Cross-Site Scripting

Published: December 31, 2025

Affected versions: *-3.9.65
Patched versions: Not supplied

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory