CVE-2023-4476

MEDIUM 6.1CVE-2023-4476 · Published 25/09/2023 · updated 17/06/2026

In short

CVE-2023-4476 is a MEDIUM (CVSS 6.1) vulnerability affecting locatoraid (plainware).
Chance of exploitation in the next 30 days (EPSS): 0.49%, higher than 42.0% of all vulnerabilities.
Fix: update to 3.9.24 or later.

Package	Affected versions	Patched versions
locatoraid plainware	`< 3.9.24`	`3.9.24`

Description

The Locatoraid Store Locator WordPress plugin before 3.9.24 does not sanitise and escape the lpr-search parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.

References

wpscan.com/vulnerability/3ca22b22-fe89-42be-94ec-b164838bcf50 · Exploit

More vulnerabilities in locatoraid

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free