Search In Place
Monthly
Reflected cross-site scripting in the codepeople 'Search in Place' WordPress plugin, versions up to and including 1.5.5, lets remote attackers supply input through the plugin's search handling that is echoed back into the generated page without proper neutralization. Because the assessed vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, no attacker authentication is needed, but the payload only executes when a victim follows a crafted link or visits a malicious page; targeting a logged-in administrator maximizes impact since the script runs in the site's origin. No public exploit identified at time of analysis, and the issue is not reported as confirmed actively exploited (CISA KEV); exploitation is limited by the user-interaction requirement.
Reflected cross-site scripting in the codepeople 'Search in Place' WordPress plugin, versions up to and including 1.5.5, lets remote attackers supply input through the plugin's search handling that is echoed back into the generated page without proper neutralization. Because the assessed vector is AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, no attacker authentication is needed, but the payload only executes when a victim follows a crafted link or visits a malicious page; targeting a logged-in administrator maximizes impact since the script runs in the site's origin. No public exploit identified at time of analysis, and the issue is not reported as confirmed actively exploited (CISA KEV); exploitation is limited by the user-interaction requirement.