Medium

DATE	CVE	VULNERABILITY TITLE	RISK
2023-09-25	CVE-2023-4476	Unspecified vulnerability in Plainware Locatoraid The Locatoraid Store Locator WordPress plugin before 3.9.24 does not sanitise and escape the lpr-search parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. network low complexity plainware	6.1
2023-06-09	CVE-2023-2031	Unspecified vulnerability in Plainware Locatoraid The Locatoraid Store Locator plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in versions up to, and including, 3.9.14 due to insufficient input sanitization and output escaping on user supplied attributes. network low complexity plainware	5.4