Vulnerability · Published May 10, 2026 · Assigned by VulnCheck

CVE-2022-50961WordPress Plugin IP2Location Country Blocker 2.26.7 Stored XSS

Medium 6.4

In plain English

A medium-severity cross-site scripting in IP2Location Country Blocker from IP2Location. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)6.4Medium

Exploit odds (30 days)0.2%top 91.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

WordPress Plugin IP2Location Country Blocker 2.26.7 contains a stored cross-site scripting vulnerability that allows authenticated users to inject arbitrary JavaScript code through the Frontend Settings interface. Attackers can inject malicious scripts in the URL field of the Display page settings that execute when administrators or other authenticated users visit the plugin settings page.

Affected products (as reported)

Vendor	Product	Versions
IP2Location	IP2Location Country Blocker	2.26.7

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

References

ExploitDB-50709 exploit
Product Reference product
VulnCheck Advisory: WordPress Plugin IP2Location Country Blocker 2.26.7 Stored XSS third-party-advisory