6.1
Medium
CVE-2023-1420 The Ajax Search Lite WordPress plugin before 4.11.1, Ajax Search Pro WordPress plugin before 4.26.2 does not sanitise…
Description
The Ajax Search Lite WordPress plugin before 4.11.1, Ajax Search Pro WordPress plugin before 4.26.2 does not sanitise and escape a parameter before outputting it back in a response of an AJAX action, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Ajax Search Lite 4.11 | earliest → < 4.11.1 | 4.11.1 |
| Ajax Search Pro 4.26 | earliest → < 4.26.2 | 4.26.2 |
Other CVEs of Ajax Search Lite
The 6 CVEs of Ajax Search Lite →
CVE-2026-16258
The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing…
9.8
Critical
CVE-2024-8619
The Ajax Search Lite WordPress plugin before 4.12.3 does not sanitise and escape some of its settings, which could…
4.8
Medium
CVE-2024-13585
The Ajax Search Lite WordPress plugin before 4.12.5 does not sanitise and escape some of its settings, which could…
3.5
Low
CVE-2024-10568
The Ajax Search Lite WordPress plugin before 4.12.4 does not sanitise and escape some of its settings, which could…
4.7
Medium