IP2Location Vulnerabilities and Affected Products - Exploit Intel

Skip to content

Products

Download IP2Location Country Blocker3 vulnerabilities
IP2Location Country Blocker3 vulnerabilities
IP2Location Redirection1 vulnerability
IP2Location Variables1 vulnerability
IP2Location World Clock1 vulnerability

IP2Location vulnerability results
Vulnerability	Title and context	CVSS	EPSS	PoCs	Signals	STIX action
CVE-2022-50961MEDIUM	WordPress Plugin IP2Location Country Blocker 2.26.7 Stored XSS WordPress Plugin IP2Location Country Blocker 2.26.7 contains a stored cross-site scripting vulnerability that allows authenticated users to inject arbitrary JavaScript code through the Frontend Settings interface. Attackers can inject malicious scripts in the URL field of the Display page settings that execute when administrators or other authenticated users visit the plugin settings page. CWE-79May 10, 2026	CVSS5.1v4.0	EPSS0.191%	PoCs1	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX
CVE-2025-1361HIGH	IP2Location Country Blocker <= 2.38.8 - Missing Authorization to Unauthenticated Information Exposure via admin_init Function The IP2Location Country Blocker plugin for WordPress is vulnerable to Regular Information Exposure in all versions up to, and including, 2.38.8 due to missing capability checks on the admin_init() function. This makes it possible for unauthenticated attackers to view the plugin's settings. CWE-285 CWE-862Feb 22, 20251 related artifact	CVSS7.5v3.1	EPSS1.27%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware use1 Nuclei template	STIX
CVE-2024-22294MEDIUM	WordPress Download IP2Location Country Blocker Plugin <= 2.33.3 is vulnerable to Sensitive Data Exposure Exposure of Sensitive Information to an Unauthorized Actor vulnerability in IP2Location IP2Location Country Blocker.This issue affects IP2Location Country Blocker: from n/a through 2.33.3. CWE-200Jan 24, 2024	CVSS5.3v3.1	EPSS0.453%	PoCs0	SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates	STIX