CVE-2026-9060

LOW

Agile Store Locator < 1.6.6 - Admin+ Stored XSS via map_style

Title source: cna
STIX 2.1

Description

The Store Locator WordPress plugin before 1.6.6 does not sanitize and escape one of its settings before storing it and outputting it on the Store Locator WordPress plugin before 1.6.6 admin page, allowing high-privileged users such as administrators to perform Stored Cross-Site Scripting attacks even when the `unfiltered_html` capability is disallowed (e.g. in a multisite network where the super admin visits the page).

References (1)

Core 1
Core References
Exploit exploit vdb-entry technical-description
https://wpscan.com/vulnerability/1ed01413-09a2-4a2e-be5b-375f2a327d0d/

Scores

CVSS v3 3.5
EPSS 0.0014
EPSS Percentile 3.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
None/Store Locator WordPress < 1.6.6
Published Jun 10, 2026
Tracked Since Jun 10, 2026