CVE-2026-9061 Overview
CVE-2026-9061 is a Stored Cross-Site Scripting (XSS) vulnerability in the Store Locator WordPress plugin in versions before 1.6.9. The plugin fails to sanitize and escape store logo metadata before storing it and rendering it on the admin page. High-privileged users such as administrators can inject persistent JavaScript payloads that execute when other administrators view the affected admin pages. The flaw allows Stored XSS even when the unfiltered_html capability is disabled, which is relevant in WordPress multisite networks where super admins typically restrict that capability. The vulnerability is classified under [CWE-79] Improper Neutralization of Input During Web Page Generation.
Critical Impact
Authenticated administrators can inject persistent JavaScript into store logo metadata, bypassing multisite restrictions intended to block HTML injection by non-super-admin users.
Affected Products
- Store Locator WordPress plugin versions prior to 1.6.9
- WordPress single-site installations using the plugin
- WordPress multisite networks where administrators lack the unfiltered_html capability
Discovery Timeline
- 2026-06-13 - CVE-2026-9061 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-9061
Vulnerability Analysis
The Store Locator plugin accepts store logo metadata from administrative input forms and writes that data into the WordPress database without sanitization. When the plugin later renders this metadata on the Store Locator admin page, it outputs the stored value without escaping. An attacker with administrator privileges can submit a crafted payload in the store logo metadata field, and the payload executes in the browser of any administrator who subsequently loads that admin page.
User interaction is required for exploitation because a victim administrator must navigate to the affected admin view. The attack requires high privileges, limiting its reach to actors who already hold administrator accounts or who have compromised one.
Root Cause
The root cause is missing input sanitization on write and missing output escaping on read for the store logo metadata field. WordPress provides sanitize_text_field(), esc_attr(), and esc_url() helpers for exactly this purpose, but the affected plugin code paths do not apply them to the logo metadata before persisting or rendering it.
Attack Vector
The attack is network-based and authenticated. An administrator submits malicious script content through the store logo metadata input. The payload persists in the database. When another administrator opens the admin page containing the rendered metadata, the script executes in that user's session context. In multisite networks this is significant because WordPress intentionally restricts the unfiltered_html capability for site administrators; this flaw bypasses that control by allowing script storage through a plugin field that does not enforce sanitization.
No verified exploit code is publicly available. See the WPScan Vulnerability Report for additional technical details.
Detection Methods for CVE-2026-9061
Indicators of Compromise
- Store logo metadata fields containing <script> tags, javascript: URIs, or event handler attributes such as onerror= or onload=
- Unexpected outbound requests from administrator browsers when viewing Store Locator admin pages
- Database rows in wp_postmeta or plugin-specific tables holding HTML markup in logo-related meta keys
Detection Strategies
- Query the WordPress database for store logo metadata entries containing HTML or script syntax and review each for legitimacy
- Inspect plugin-rendered admin pages with browser developer tools to verify that logo fields render as escaped text rather than executing markup
- Review WordPress audit logs for administrator account activity that modified store entries shortly before the issue was observed
Monitoring Recommendations
- Monitor administrator session activity for anomalous API calls or content changes that may indicate XSS-driven actions
- Alert on creation or modification of WordPress user accounts with elevated roles following administrator logins
- Track installed plugin versions across managed WordPress sites and flag any Store Locator installations below 1.6.9
How to Mitigate CVE-2026-9061
Immediate Actions Required
- Update the Store Locator plugin to version 1.6.9 or later on all WordPress sites and multisite networks
- Audit existing store logo metadata for injected HTML or script content and sanitize or remove suspicious entries
- Review administrator accounts and revoke access for any account that should not retain administrative privileges
Patch Information
The vendor addressed the vulnerability in Store Locator plugin version 1.6.9 by adding sanitization and escaping for store logo metadata. Site operators should upgrade through the WordPress plugin manager or by deploying the updated plugin package from the official repository.
Workarounds
- Restrict administrator account assignments to trusted personnel until the patched version is deployed
- Deactivate the Store Locator plugin on multisite networks where untrusted administrators exist
- Apply a Web Application Firewall rule to block script-like payloads submitted to plugin admin endpoints
# Update the Store Locator plugin using WP-CLI
wp plugin update store-locator --version=1.6.9
wp plugin list --name=store-locator --fields=name,status,version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
