Medium severity · published May 10, 2026
CVE-2022-50961
WordPress Plugin IP2Location Country Blocker 2.26.7 Stored XSS
6.4
CVSS
0.2%
EPSS
No
On KEV
Description
WordPress Plugin IP2Location Country Blocker 2.26.7 contains a stored cross-site scripting vulnerability that allows authenticated users to inject arbitrary JavaScript code through the Frontend Settings interface. Attackers can inject malicious scripts in the URL field of the Display page settings that execute when administrators or other authenticated users visit the plugin settings page.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 9% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IC
IP2Location Country Blocker · IP2Location
2.26.7 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-50961
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-50961
wordpress.org
https://wordpress.org/plugins/ip2location-country-blocker/
www.exploit-db.com
https://www.exploit-db.com/exploits/50709
www.vulncheck.com
https://www.vulncheck.com/advisories/wordpress-plugin-ip2location-country-blocker-stored-xss
More from IP2Location Country Blocker
5.3
CVE-2026-82530
IP2Location Country Blocker < 2.45.0 Access Control Bypass via X-Real-IP Header