Fibosearch Ajax Search For Woocommerce
Monthly
Stored cross-site scripting in the FiboSearch - Ajax Search for WooCommerce WordPress plugin, in all versions up to and including 1.34.2, lets an authenticated attacker with Subscriber-level access or above inject arbitrary JavaScript through the 'purchased_plan' parameter that later executes in the browser of any user viewing the affected admin page. Exploitation is gated by a non-default precondition: the site owner must have already completed the standard Freemius opt-in flow, after which a Subscriber can trigger the vulnerable handler simply by loading /wp-admin/profile.php with crafted query parameters. Scored CVSS 3.1 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), the issue is confirmed fixed in 1.34.3; no public exploit code has been identified at time of analysis, and it is not listed as actively exploited.
Stored cross-site scripting in the FiboSearch - Ajax Search for WooCommerce WordPress plugin, in all versions up to and including 1.34.2, lets an authenticated attacker with Subscriber-level access or above inject arbitrary JavaScript through the 'purchased_plan' parameter that later executes in the browser of any user viewing the affected admin page. Exploitation is gated by a non-default precondition: the site owner must have already completed the standard Freemius opt-in flow, after which a Subscriber can trigger the vulnerable handler simply by loading /wp-admin/profile.php with crafted query parameters. Scored CVSS 3.1 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), the issue is confirmed fixed in 1.34.3; no public exploit code has been identified at time of analysis, and it is not listed as actively exploited.