The Store Locator WordPress plugin versions prior to 1.6.6 contain a stored cross-site scripting vulnerability (CWE-79). This occurs because the plugin fails to sanitize and escape one of its settings before storing and rendering it on the admin page. As a result, high-privileged users including administrators can inject malicious scripts that persist and execute when the affected admin page is viewed. This vulnerability bypasses restrictions like the 'unfiltered_html' capability, increasing risk in multisite WordPress networks.

An attacker with high-level privileges (e.g., administrator) can exploit this vulnerability to perform stored XSS attacks within the WordPress admin interface. This could lead to execution of arbitrary JavaScript in the context of the admin user, potentially enabling session hijacking, privilege escalation, or other malicious actions. However, exploitation requires administrative access, limiting the scope to trusted users with elevated permissions.

No official fix or patch is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted users only and monitor for suspicious activity. Avoid using affected versions if possible and apply updates once version 1.6.6 or later is released.