The Store Locator WordPress plugin versions prior to 1.6.6 contain a stored cross-site scripting (CWE-79) vulnerability. This occurs because one of the plugin's settings is not sanitized or escaped before being stored and output on the admin page. As a result, high-privileged users like administrators can inject malicious scripts that persist and execute when the admin page is viewed. This vulnerability is exploitable even when the unfiltered_html capability is disallowed, such as in multisite WordPress environments where super admins access the page. No official patch or remediation level has been provided in the available data.

An attacker with high privileges (e.g., administrator) can inject and store malicious scripts that execute in the context of the admin page. This could lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed by the admin user. The CVSS score of 3.5 reflects a low severity impact with no availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted users only and consider monitoring for suspicious activity on the affected plugin's admin pages. Avoid granting unnecessary high privileges that could exploit this vulnerability.