YITH Ajax Search CVE-2026-96352

Exploitation requires a victim to interact with attacker-supplied input - clicking a crafted link or submitting a manipulated request against a site running YITH WooCommerce Ajax Search <= 2.28.0 (which also requires WooCommerce and WordPress). No authentication is required of the attacker (PR:N), but the mandatory user interaction (UI:R) is the primary limiting factor, making this a social-engineering-dependent attack rather than a fully autonomous one. The exact vulnerable parameter/endpoint is not disclosed in the advisory, so defenders should treat the plugin's Ajax search input surface as the likely injection point.

This is a genuine but moderate-priority issue rather than an urgent one. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1) shows a network-reachable, low-complexity, unauthenticated flaw - but crucially requires user interaction (UI:R), which is characteristic of reflected/DOM XSS where a victim must be lured into triggering a crafted request or link. The scope change (S:C) reflects XSS executing in the browser/DOM context beyond the vulnerable component, and the C:L/I:L/A:L impacts are the typical low-tier browser-side consequences of script injection (session/token theft, limited UI manipulation). No EPSS score, no CISA KEV listing, and no public POC were provided in the intelligence, so per available data there is no public exploit identified at time of analysis and no evidence of active exploitation. The only source is a single Patchstack advisory. The elevated 7.1 is driven largely by PR:N + S:C, not by high impact; net real-world risk is moderate and gated by the requirement to socially engineer a victim.

An attacker crafts a malicious URL or form input targeting an unsanitized parameter in YITH WooCommerce Ajax Search (<=2.28.0) and lures a store visitor or administrator into clicking it. When the page reflects the payload without proper encoding, attacker-controlled JavaScript executes in the victim's browser session, enabling cookie/session theft or actions in the victim's context. No public exploit code was identified in the provided data, and successful exploitation depends on the victim interacting with the crafted link (UI:R).