Quick answers
- Is CVE-2026-9061 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-9061 being exploited in the wild.
- How severe is CVE-2026-9061?
- Informational severity, with a CVSS score of 3.5, published 13 June 2026.
- Which products and versions are affected?
- AgileLogix Agile Store Locator < 1.6.9.
- Is there a fix for CVE-2026-9061?
- A patch was published on 2026-06-13: Confirmed fixed in version 1.6.9 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-9061 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-9061?
- Check whether you run AgileLogix Agile Store Locator at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Agile Store Locator plugin for WordPress due to insufficient sanitization and escaping of store logo metadata (specifically the 'logo_name' field) before it is stored and rendered on the admin dashboard. An attacker with administrative privileges can exploit this by sending a crafted AJAX request to the 'asl_ajax_handler' with a malicious payload in the 'data[logo_name]' parameter. The vulnerability is particularly relevant in WordPress multisite environments where 'unfiltered_html' is disabled for subsite admins. When an administrator visits the 'manage-store-logos' page, the payload executes via the DataTables component. The issue is fixed in version 1.6.9.
Affected products
- AgileLogix Agile Store Locator < 1.6.9
Timeline
- 2026-05-23: disclosed: Initial public disclosure by WPScan
- 2026-06-13: advisory: NVD publication date
- 2026-06-13: patched: Confirmed fixed in version 1.6.9