FiboSearch CVE-2026-96553

Exploitation requires the FiboSearch (ajax-search-for-woocommerce) plugin version n/a through 1.34.1 to be installed and active on a publicly reachable WooCommerce site, and critically requires victim interaction (UI:R): the attacker cannot trigger the payload alone but must convince a user to click a specially crafted link while they visit the affected store. No authentication is needed on the attacker side (PR:N). The practical limiting factors are the mandatory social-engineering/click step, the fact that impact is confined to the victim's browser session rather than the server, and that only installations running ≤ 1.34.1 are affected - upgrading to a fixed release removes exposure.

This is a reflected cross-site scripting (CWE-79) flaw in the FiboSearch WordPress/WooCommerce plugin, scored CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) by the reporter Patchstack. The network vector with low complexity and no privileges (PR:N) means any remote, unauthenticated attacker can craft a malicious payload, but the UI:R requirement means a victim must be lured into clicking a crafted link, which materially lowers real-world risk versus a no-interaction flaw. No EPSS score, CISA KEV listing, or public proof-of-concept was provided in the intelligence, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The scope-change (S:C) and low confidentiality/integrity/availability impacts reflect the typical browser-context compromise of reflected XSS rather than server takeover. Net assessment: a legitimately medium-to-high priority for internet-facing WooCommerce stores because of the unauthenticated network vector and large plugin install base, but tempered by the mandatory user interaction and absence of any exploitation signal - this is a patch-in-normal-cycle issue, not an emergency, unless the store is a high-value phishing/account-takeover target.

An attacker crafts a URL containing a malicious script payload that is reflected unsanitized into a FiboSearch-generated page on a vulnerable WooCommerce store (version ≤ 1.34.1) and delivers it to a victim via phishing email, malicious ad, or a link on another site. When the victim clicks the link while browsing the target store, the script executes in their browser session, enabling session cookie theft, credential harvesting, or actions on the victim's behalf. No public proof-of-concept was provided in the available data.