What is the CVSS score of CVE-2026-28179?

CVE-2026-28179 has a CVSS 3.1 base score of 5.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

FiboSearch CVE-2026-28179

EUVD-2026-53951 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Patchstack

GHSA-5w42-jqc8-p89x

WordPress XSS Wordpress Plugin Fibosearch

5.9

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.9 MEDIUM

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

4.8 MEDIUM

Shop manager authentication (PR:H) and victim page-load (UI:R) are required; no availability impact identified for this XSS class.

3.1 AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 16:00 vuln.today

DescriptionCVE.org

Shop manager Cross Site Scripting (XSS) in FiboSearch <= 1.33.0 versions.

AnalysisAI

Cross-site scripting in FiboSearch (Ajax Search for WooCommerce) versions up to and including 1.33.0 allows authenticated shop managers to inject malicious JavaScript that executes in the browsers of other users visiting the WordPress storefront. The Changed scope in the CVSS vector (S:C) confirms the attack crosses a security boundary, meaning a compromised or malicious shop manager account can target customers or higher-privileged administrators. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the insider-threat and credential-compromise scenarios make this relevant to multi-user WooCommerce deployments.

Technical ContextAI

FiboSearch (CPE: cpe:2.3:a:damian_góra:fibosearch:*:*:*:*:*:*:*:*) is a WooCommerce AJAX search plugin for WordPress. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning shop manager-controlled input is stored or rendered in page output without adequate sanitization or output escaping. WordPress's shop manager role holds broad WooCommerce-scoped permissions but is intentionally below administrator level - the Changed scope in the CVSS vector indicates the injected payload escapes the shop manager's own session boundary and executes in the victim user's browser context, potentially accessing their session tokens or performing actions on their behalf.

RemediationAI

Update FiboSearch to the version released after 1.33.0 via the WordPress plugin dashboard (Plugins → Updates) or the WordPress.org plugin repository. The Patchstack advisory (https://patchstack.com/database/wordpress/plugin/ajax-search-for-woocommerce/vulnerability/wordpress-fibosearch-plugin-1-33-0-cross-site-scripting-xss-vulnerability) should be consulted to confirm the exact patched release version, as no specific fix version number was independently confirmed in the available intelligence. If an immediate update is not feasible, reduce the number of accounts holding the shop manager role to the minimum necessary and enforce multi-factor authentication on all privileged WordPress accounts to reduce the risk of credential compromise. A web application firewall with XSS filtering rules can serve as a compensating control but should not substitute for patching, as WAF rules may not catch all payload variants. Temporarily deactivating the FiboSearch plugin is the most effective interim mitigation if the operational impact is acceptable.