CVE-2014-8621: Store Locator Project Store Locator

Critical severity, CVSS 9.8. EPSS: 3% chance of exploitation in the next 30 days.

SQL injection vulnerability in the Store Locator plugin 2.3 through 3.11 for WordPress allows remote attackers to execute arbitrary SQL commands via the sl_custom_field parameter to sl-xml.php.

Affected products

• Store Locator Project Store Locator: version 2.3 only; version 3.11 only

Published 2017-10-16. Last modified 2026-06-17.