blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2021-24290

MEDIUM 6.1 CVSS 3.1
Published
May 17, 2021
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-79
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

There are several endpoints in the Store Locator Plus for WordPress plugin through 5.5.15 that could allow unauthenticated attackers the ability to inject malicious JavaScript into pages.

Affected products and versions

  • Store Locator Plus® Store Locator Plus for WordPress — From 5.5.15 (including) to 5.5.15 (including)
  • de-baat store_locator_plus — Up to and including 5.5.15

References

  • wpscan.com https://wpscan.com/vulnerability/dc368484-f2fe-4c76-ba3d-e00e7f633719 Third Party Advisory
  • www.wordfence.com https://www.wordfence.com/blog/2021/04/severe-unpatched-vulnerabilities-leads-to-closure-of-store-locator-plus-plugin Third Party Advisory
  • nvd.nist.gov Official NVD record