CVE-2026-9060: 
WordPress vulnerability analysis and mitigation

CVE-2026-9060 is a Stored Cross-Site Scripting (XSS) vulnerability in the Agile Store Locator WordPress plugin (also referred to as "Store Locator") affecting all versions before 1.6.6. The flaw allows high-privileged users (administrators) to inject malicious JavaScript via the map_style setting, which is then executed in the browsers of other administrators or super administrators who visit the plugin's settings page. It was publicly disclosed on May 20, 2026, and assigned a CVSS v3.1 base score of 3.5 (Low) (WPScan, GitHub Advisory).

The root cause is improper input sanitization and output escaping (CWE-79) of the map_style plugin setting before it is stored in the database and rendered on the admin page (/wp-admin/admin.php?page=asl-settings). An authenticated administrator can submit a crafted payload via the save_setting AJAX handler (admin-ajax.php, action asl_ajax_handler, sub-action save_setting) without the unfiltered_html capability, bypassing WordPress's standard HTML filtering. The payload breaks out of a JavaScript context and executes as a <script> block when any administrator or super administrator loads the settings page (WPScan, GitHub Advisory).

Successful exploitation allows an attacker with administrator-level access to execute arbitrary JavaScript in the browser sessions of other administrators or super administrators, including those in WordPress multisite environments. This can lead to session token theft, unauthorized administrative actions (such as creating rogue admin accounts or modifying site configuration), and potential full site compromise. Confidentiality and integrity impacts are low per CVSS scoring, and there is no direct availability impact (WPScan, GitHub Advisory).

1. Reconnaissance: Identify WordPress sites running the Agile Store Locator plugin at version 1.6.5 or earlier. This can be done by checking the plugin's readme.txt or changelog exposed at /wp-content/plugins/agile-store-locator/readme.txt.
2. Obtain administrator credentials: Gain access to an administrator account on the target WordPress site (e.g., via credential stuffing, phishing, or a separate vulnerability).
3. Extract the nonce: Visit /wp-admin/admin.php?page=asl-settings and extract the nounce value from the page source (assigned to ASL_REMOTE.nounce or embedded in a JSON literal).
4. Inject the XSS payload: Send a crafted POST request to the save_setting AJAX handler with a malicious map_style value:

curl -k -c jar -b jar -X POST 'https://target/wp-admin/admin-ajax.php' \
  --data-urlencode 'action=asl_ajax_handler' \
  --data-urlencode 'sl-action=save_setting' \
  --data-urlencode 'asl-nounce=<EXTRACTED_NONCE>' \
  --data-urlencode 'map_style=alert(/XSS-map_style/)' \
  --data-urlencode 'slug_attr_ddl=' \
  --data-urlencode 'data[remove_maps_script]=0'

5. Trigger execution: When any administrator or super administrator visits /wp-admin/admin.php?page=asl-settings, the stored payload executes in their browser, enabling session hijacking, credential theft, or further administrative actions (WPScan).

• Network: Unusual POST requests to /wp-admin/admin-ajax.php with parameters action=asl_ajax_handler and sl-action=save_setting containing script tags or JavaScript payloads in the map_style field.
• Logs: WordPress access logs showing POST requests to admin-ajax.php with encoded or obfuscated map_style values; repeated admin page visits to asl-settings from different administrator accounts in a short timeframe.
• File System / Database: The map_style setting in the WordPress database (wp_options table, option name related to Agile Store Locator) containing <script> tags, JavaScript event handlers, or encoded payloads.
• Browser/Session: Unexpected administrative actions (new admin user creation, plugin/theme changes, settings modifications) occurring shortly after an administrator visits the Store Locator settings page (WPScan).

Update the Agile Store Locator WordPress plugin to version 1.6.6 or later, which includes proper sanitization and escaping of the map_style setting. No configuration-based workaround is available; upgrading is the only effective remediation. In multisite environments, super administrators should prioritize this update and audit the map_style database value for any existing malicious content (WPScan, GitHub Advisory).

The vulnerability was included in Wordfence's weekly WordPress vulnerability report for June 8–14, 2026, providing broader community visibility (Wordfence Blog). The CVE was also noted on social media via CVEnew. No significant independent researcher commentary or major media coverage has been identified beyond standard vulnerability aggregator listings.