Advance Search Vulnerabilities

The Advanced Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data parameter in all versions up to, and including, 1.1.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator access or higher, to inject arbitrar...

CVSS:

7.2

Affected:

up to 1.1.6

Fix:

No patched version reported

Disclosed:

Apr 4, 2024

CVE-2024-3265 on NVD →

The Advanced Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.1.6. This is due to missing or incorrect nonce validation on the WPAS_Advanced_Search_extra_ajax AJAX action. This makes it possible for unauthenticated attackers to delete shortcodes via a forge...

CVSS:

4.3

Affected:

up to 1.1.6

Fix:

No patched version reported

Disclosed:

Mar 25, 2024

CVE-2024-2739 on NVD →

The Advance Search WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the wpas_id parameter found in the ~/inc/admin/views/html-advance-search-admin-options.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.1.2.

CVSS:

6.1

Affected:

up to 1.1.2

Fixed in:

1.1.3

Disclosed:

Sep 9, 2021

CVE-2021-38348 on NVD →