CVE-2025-49328: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Agile Logix Store Locator WordPress
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Agile Logix Store Locator WordPress agile-store-locator allows SQL Injection.This issue affects Store Locator WordPress: from n/a through <= 1.5.1.
AI Analysis
Technical Summary
This vulnerability in Agile Logix Store Locator WordPress plugin (versions <= 1.5.1) is due to improper neutralization of special elements in SQL commands, leading to SQL Injection. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, and scope change with high confidentiality impact and low availability impact. No patch or vendor advisory is currently available, and the plugin is not a cloud service.
Potential Impact
An attacker with high privileges on the affected WordPress installation could exploit this SQL Injection vulnerability to access or manipulate sensitive data in the backend database, impacting confidentiality. The availability impact is low, and integrity impact is not indicated. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and limit high-privilege user accounts. Monitor for updates from Agile Logix regarding a security patch.
CVE-2025-49328: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in Agile Logix Store Locator WordPress
Description
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Agile Logix Store Locator WordPress agile-store-locator allows SQL Injection.This issue affects Store Locator WordPress: from n/a through <= 1.5.1.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability in Agile Logix Store Locator WordPress plugin (versions <= 1.5.1) is due to improper neutralization of special elements in SQL commands, leading to SQL Injection. The CVSS 3.1 vector indicates network attack vector, low attack complexity, high privileges required, no user interaction, and scope change with high confidentiality impact and low availability impact. No patch or vendor advisory is currently available, and the plugin is not a cloud service.
Potential Impact
An attacker with high privileges on the affected WordPress installation could exploit this SQL Injection vulnerability to access or manipulate sensitive data in the backend database, impacting confidentiality. The availability impact is low, and integrity impact is not indicated. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and limit high-privilege user accounts. Monitor for updates from Agile Logix regarding a security patch.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Patchstack
- Date Reserved
- 2025-06-04T09:42:17.747Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6842ede271f4d251b5c88180
Added to database: 6/6/2025, 1:32:18 PM
Last enriched: 5/1/2026, 3:25:29 PM
Last updated: 5/10/2026, 1:57:28 AM
Views: 63
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.