Superstorefinder operates a modestly represented web application and PHP-based product line that skews strongly toward critical-severity outcomes. The recurring vulnerability pattern centers on input-handling and authentication gaps—SQL injection, cross-site scripting, injection flaws, missing authorization, and hard-coded credentials—characteristic of web applications with insufficient input validation and access control. Defenders should apply strict input sanitization, parameterized queries, and credential rotation practices when deploying these products; live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Superstorefinder over time
Signals from CVEs in this vendor scope (11 CVEs).
11 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-43976CRITICAL Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in highwarden Super Store Finder superstorefinder-wp.This issue affects Super Sto | Sep 17, 2024 | 9.8 | 30 | NO | NO |
CVE-2023-38912CRITICAL SQL injection vulnerability in Super Store Finder PHP Script v.3.6 allows a remote attacker to execute arbitrary code via a crafted payload to the username parameter. | Sep 14, 2023 | 9.8 | 30 | NO | NO |
CVE-2024-43978CRITICAL Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in highwarden Super Store Finder superstorefinder-wp.This issue affects Super Sto | Sep 17, 2024 | 9.8 | 27 | NO | NO |
CVE-2023-41507CRITICAL Super Store Finder v3.6 was discovered to contain multiple SQL injection vulnerabilities in the store locator component via the products, distance, lat, and lng parameters. | Sep 5, 2023 | 9.8 | 26 | NO | NO |
CVE-2023-41508CRITICAL A hard coded password in Super Store Finder v3.6 allows attackers to access the administration panel. | Sep 5, 2023 | 9.8 | 26 | NO | NO |
CVE-2023-3751CRITICAL A vulnerability was found in Super Store Finder 3.6. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /index.php of the comp | Jul 19, 2023 | 9.8 | 26 | NO | NO |
CVE-2024-13440HIGH The Super Store Finder plugin for WordPress is vulnerable to SQL Injection via the ‘ssf_wp_user_name’ parameter in all versions up to, and including, 7.0 due to insufficient escapi | Feb 9, 2025 | 8.2 | 24 | NO | NO |
CVE-2023-43835HIGH Super Store Finder 3.7 and below is vulnerable to authenticated Arbitrary PHP Code Injection that could lead to Remote Code Execution when settings overwrite config.inc.php content | Oct 2, 2023 | 8.8 | 24 | NO | NO |
CVE-2023-44044HIGH Super Store Finder v3.6 and below was discovered to contain a SQL injection vulnerability via the Search parameter at /admin/stores.php. | Sep 27, 2023 | 7.2 | 20 | NO | NO |
CVE-2024-43975MEDIUM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in highwarden Super Store Finder superstorefinder-wp.This issue affects Super Sto | Sep 18, 2024 | 6.1 | 18 | NO | NO |
Signals from CVEs in this vendor scope (11 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Superstorefinder.
Media articles that mention a CVE ID that affects a product developed by Superstorefinder — matched by CVE ID, not by vendor name.