What’s Vulnerable › Vulnerabilities

CVE-2022-50961: WordPress Plugin IP2Location Country Blocker 2.26.7 Stored XSS

• Severity: medium (CVSS 6.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-05-10 · updated 2026-07-24
• Weakness: CWE-79

Description

WordPress Plugin IP2Location Country Blocker 2.26.7 contains a stored cross-site scripting vulnerability that allows authenticated users to inject arbitrary JavaScript code through the Frontend Settings interface. Attackers can inject malicious scripts in the URL field of the Display page settings that execute when administrators or other authenticated users visit the plugin settings page.

Affected products

• IP2Location Country Blocker: 2.26.7

References

• https://wordpress.org/plugins/ip2location-country-blocker/
• https://www.exploit-db.com/exploits/50709
• https://www.vulncheck.com/advisories/wordpress-plugin-ip2location-country-blocker-stored-xss

Get alerted when CVE-2022-50961 or the next vulnerability affects your stack