The Store Locator WordPress plugin versions prior to 1.6.9 do not properly sanitize and escape metadata related to store logos before storing and rendering it on the plugin's admin page. This flaw enables users with high privileges (e.g., administrators) to inject and execute stored cross-site scripting payloads, bypassing restrictions such as the lack of unfiltered_html capability. The vulnerability is tracked as CVE-2026-9061 and is classified under CWE-79 (Cross-Site Scripting). The CVSS v3.1 base score is 3.5, reflecting low impact. There is no vendor advisory or patch information available at this time.

An attacker with high privileges on a WordPress site using the affected Store Locator plugin can inject malicious scripts into the store logo metadata. These scripts execute in the context of the admin page, potentially leading to limited confidentiality and integrity impacts within the administrative interface. The vulnerability does not affect availability and requires user interaction (admin page access). There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict administrative access to trusted users only and monitor for suspicious activity related to the Store Locator plugin. Avoid granting unnecessary high privileges to users. No official fix or temporary workaround has been published.