CVE-2026-81768: Super Store Finder XSS Vulnerability

CVE-2026-81768 Overview

CVE-2026-81768 is an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting the Super Store Finder plugin for WordPress in versions 7.10 and earlier. The flaw is classified under CWE-79, Improper Neutralization of Input During Web Page Generation. An unauthenticated attacker can inject malicious JavaScript that executes in a victim's browser when a crafted link or page is loaded. The scope change component of the score indicates that successful exploitation can affect resources beyond the vulnerable component, including the WordPress administrator context.

Critical Impact
Unauthenticated attackers can execute arbitrary JavaScript in the browser context of site visitors and administrators, enabling session theft, credential harvesting, and administrative account takeover.

Affected Products

WordPress Super Store Finder plugin (superstorefinder-wp) versions up to and including 7.10
WordPress sites publicly exposing plugin endpoints to unauthenticated users
Any WordPress installation running the vulnerable plugin regardless of theme or hosting environment

Discovery Timeline

2026-08-31 - CVE-2026-81768 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-81768

Vulnerability Analysis

The Super Store Finder plugin fails to properly neutralize user-supplied input before reflecting it into HTML output. Because the vulnerability is reachable without authentication, any internet-connected attacker can craft a request that returns attacker-controlled markup. The scope change property indicates the payload can pivot from the plugin's rendering context into the broader WordPress administrative context, making it valuable for account takeover chains. User interaction is required, so exploitation depends on a target clicking a crafted link or visiting an attacker-controlled resource.

Root Cause

The root cause is missing or insufficient output encoding on request parameters processed by the plugin. Input that should be escaped using WordPress functions such as esc_html(), esc_attr(), or wp_kses() is instead concatenated directly into HTML responses. This aligns with the CWE-79 class of Improper Neutralization of Input During Web Page Generation.

Attack Vector

An attacker crafts a URL to a vulnerable plugin endpoint on a target WordPress site with a JavaScript payload embedded in a reflected parameter. The attacker delivers this URL through phishing, forum posts, or malicious advertisements. When a logged-in administrator clicks the link, the injected script executes with the administrator's session, allowing actions such as creating new admin users, modifying plugin settings, or exfiltrating cookies. Refer to the Patchstack Vulnerability Report for advisory-level technical details.

Detection Methods for CVE-2026-81768

Indicators of Compromise

Web server access logs containing requests to superstorefinder-wp endpoints with URL parameters carrying <script>, onerror=, javascript:, or encoded variants such as %3Cscript%3E
Creation of unexpected WordPress administrator accounts following an admin visit to a crafted link
Unexpected outbound requests from administrator browsers to attacker-controlled domains shortly after loading plugin URLs
Modifications to plugin or theme files, or newly added scheduled tasks (wp_cron events) without a corresponding change ticket

Detection Strategies

Deploy Web Application Firewall (WAF) rules that flag reflected script tags and event handler attributes on query parameters targeting /wp-content/plugins/superstorefinder-wp/
Correlate HTTP request logs with WordPress wp_users table changes to identify session-abuse chains originating from XSS
Hunt in endpoint telemetry for browser processes spawning credential-dumping or download activity immediately after visits to WordPress admin URLs

Monitoring Recommendations

Ingest WordPress access logs and audit logs into a centralized analytics platform and alert on parameter values that decode to HTML control characters
Monitor for administrator role assignments, plugin installations, and option changes and require step-up verification for anomalous events
Track referrer headers on /wp-admin/ traffic to detect administrators arriving from external, non-corporate domains

How to Mitigate CVE-2026-81768

Immediate Actions Required

Identify all WordPress installations running the Super Store Finder plugin and confirm the installed version against 7.10
Update the superstorefinder-wp plugin to the latest vendor-supplied version once a patched release is available
Rotate administrator passwords and invalidate active sessions on any site where administrators may have followed untrusted links
Enable multi-factor authentication for all WordPress administrator accounts to limit the value of stolen session cookies

Patch Information

Consult the Patchstack Vulnerability Report for the current fixed version and vendor guidance. Apply the fixed release through the WordPress plugin manager or via wp-cli using wp plugin update superstorefinder-wp. Verify the installed version after update.

Workarounds

Deactivate and remove the Super Store Finder plugin until a patched version is installed if the store locator feature is not business-critical
Deploy a WAF rule that blocks requests to plugin endpoints containing <, >, or javascript: in query parameters
Enforce a strict Content Security Policy (CSP) that disallows inline scripts and restricts script sources to trusted origins to reduce XSS impact

bash

# Configuration example: check plugin version and update via wp-cli
wp plugin get superstorefinder-wp --field=version
wp plugin update superstorefinder-wp
wp plugin deactivate superstorefinder-wp  # if patched version is not yet available