Executive brief
The Agile Store Locator plugin for WordPress, which helps businesses display physical locations on a map, contains a security flaw in how it handles store logo information. An authorized user with administrative access can upload malicious code disguised as logo metadata. If another administrator views the logo management page, this code could execute in their browser, potentially leading to unauthorized actions or data access within the website's management console.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Agile Store Locator plugin for WordPress due to insufficient sanitization and escaping of store logo metadata (specifically the 'logo_name' field) before it is stored and rendered on the admin dashboard. An attacker with administrative privileges can exploit this by sending a crafted AJAX request to the 'asl_ajax_handler' with a malicious payload in the 'data[logo_name]' parameter. The vulnerability is particularly relevant in WordPress multisite environments where 'unfiltered_html' is disabled for subsite admins. When an administrator visits the 'manage-store-logos' page, the payload executes via the DataTables component. The issue is fixed in version 1.6.9.
Affected products
- AgileLogix Agile Store Locator < 1.6.9
Timeline
- 2026-05-23: disclosed: Initial public disclosure by WPScan
- 2026-06-13: advisory: NVD publication date
- 2026-06-13: patched: Confirmed fixed in version 1.6.9