Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Not this one?Store LocatorStore LocatorWP Multistore LocatorWP Store LocatorG Web Pro Store LocatorStore Locator WidgetJSP Store LocatorThemify Store Locator
Plugin · store-locator
Store Locator
3 known vulnerabilities on record. Add your version above to see which ones affect you.
Jan 24, 2025Store Locator: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2025-23422 · affects up to 3.98.10 · reported by PatchstackHigh 7.5
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in moaluko Store Locator store-locator allows PHP Local File Inclusion.This issue affects Store Locator: from n/a through <= 3.98.10.
Dec 20, 2024Store Locator for WordPress with Google Maps – LotsOfLocales: Local File Inclusion in version 3CVE-2024-12571 · reported by WordfenceCritical 9.8
The Store Locator for WordPress with Google Maps – LotsOfLocales plugin for WordPress is vulnerable to Local File Inclusion in version 3.98.9 via the 'sl_engine' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other “safe” file types can be uploaded and included.
May 24, 2023Cross-Site Request Forgery (CSRF) vulnerability in Viadat Creations Store Locator for WordPress with Google Maps – LotsOfLocales plugin <= 3.98.7 versions.CVE-2022-47446 · fixed in 3.98.8 · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in Viadat Creations Store Locator for WordPress with Google Maps – LotsOfLocales plugin <= 3.98.7 versions.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.