EUVD-2026-14154
GHSA-hpfx-9vj4-xr9j
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
The Ricerca - advanced search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's settings in all versions up to, and including, 1.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
AnalysisAI
A Stored Cross-Site Scripting (XSS) vulnerability exists in the Ricerca - advanced search WordPress plugin affecting all versions up to and including 1.1.12, caused by insufficient input sanitization and output escaping in the plugin's settings interface. Only authenticated administrators on multi-site WordPress installations or those with unfiltered_html disabled are able to inject malicious scripts that execute for all users viewing affected pages. The CVSS score of 4.4 reflects the requirement for high-privilege administrative access and specific configuration conditions, though the impact remains meaningful given the scope of affected multi-site deployments.
Technical ContextAI
The vulnerability is rooted in CWE-79 (Improper Neutralization of Input During Web Page Generation), a classic web application input validation flaw. The Ricerca plugin, identified via CPE (cpe:2.3:a:systemsrtk:ricerca_–_advanced_search:*:*:*:*:*:*:*:*), fails to properly sanitize user input received through its administrative settings fields and does not adequately escape output when rendering those settings in plugin pages. The vulnerability manifests in the admin_fields.php component (referenced in the WordPress plugin repository at line 689), which processes administrator-provided configuration values without adequate security controls. This affects only specific WordPress configurations: multi-site installations where site administrators can modify plugin settings, or single-site installations where the unfiltered_html capability has been explicitly disabled, preventing the default HTML filtering that would normally block injected scripts.
RemediationAI
Update the Ricerca – advanced search plugin to a version newer than 1.1.12 immediately (check the official WordPress plugin repository for the latest patched version). Until an update is available or can be deployed, restrict administrative access to only trusted personnel and regularly audit plugin settings for any suspicious or unexpected content. On multi-site WordPress installations, consider temporarily disabling the Ricerca plugin if it is not critical to operations, or ensure that only highly trusted administrators have access to modify its settings. Additionally, enable and maintain WordPress security hardening practices including using security plugins that provide Content Security Policy (CSP) headers to mitigate stored XSS impact, and ensure unfiltered_html capability remains disabled on installations where feasible to provide defense-in-depth protection.
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today