plugin
26 known security issues reported for the Ajax Search Lite WordPress plugin. Most recent disclosed Aug 4, 2026.
Running Ajax Search Lite on your site? Check whether your installed version is affected.
Scan your site freeThe Ajax Search Lite – Live Search & Filter plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.14.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. I...
The Ajax Search Lite plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.14.4 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is presen...
[en] Deserialization of Untrusted Data vulnerability in wpdreams Ajax Search Lite ajax-search-lite allows Object Injection.This issue affects Ajax Search Lite: from n/a through <= 4.13.3.
The Ajax Search Lite plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.13.3 via deserialization of untrusted input. This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vul...
The Ajax Search Lite plugin for WordPress is vulnerable to Basic Information Exposure due to missing authorization in its AJAX search handler in all versions up to, and including, 4.13.1. This makes it possible for unauthenticated attackers to issue repeated AJAX requests to leak the content of any protected post in ro...
[en] The Ajax Search Lite WordPress plugin before 4.12.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
The Ajax Search Lite – Live Search & Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissio...
[en] The Ajax Search Lite WordPress plugin before 4.12.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
The Ajax Search Lite – Live Search & Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.12.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissio...
[en] The Ajax Search Lite WordPress plugin before 4.12.1 does not sanitise and escape some parameters, which could allow users with a role as low as Admin+ to perform Cross-Site Scripting attacks.
The Ajax Search Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject...
The Ajax Search Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject a...
[en] Cross-Site Request Forgery (CSRF) vulnerability in Ernest Marcinko Ajax Search Lite allows Reflected XSS.This issue affects Ajax Search Lite: from n/a through 4.11.4.
The Ajax Search Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.11.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user a...
[en] The Ajax Search Lite WordPress plugin before 4.11.1, Ajax Search Pro WordPress plugin before 4.26.2 does not sanitise and escape a parameter before outputting it back in a response of an AJAX action, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
The Ajax Search Lite plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.11 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully...
[en] Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Ernest Marcinko Ajax Search Lite plugin <= 4.10.3 versions.
The Ajax Search Lite plugin for WordPress is vulnerable to Missing Authorization (leading to Sensitive Information Disclosure) in versions up to, and including, 4.10.3 via the 'searchCF' function. This can allow subscriber-level attackers to extract sensitive data including post metadata from an unprotected Ajax endpoi...
The Ajax Search Lite plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wpdreams_ajaxinputcallback function in versions up to, and including, 3.10. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to bypass restricted actio...
The Ajax Search Lite plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wpdreams_ajaxinputcallback function in versions up to, and including, 3.10. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to bypass restricted actio...
Because of this vulnerability, any registered user to execute any function he wants with 1st param set to array($_POST). Update the plugin.
This vulnerability allows any registered user to execute any function he wants. Upgrade the plugin.
The Ajax Search Lite plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.10 via the TimThumb’s "Webshot" feature. This allows unauthenticated attackers to execute code on the server.
The Ajax Search Lite plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.10 via the TimThumb’s "Webshot" feature. This allows unauthenticated attackers to execute code on the server.
Proof of Concept: This will register an administrator with username "xADMIN" and password "xPASS": POST request to: /wp-admin/admin-ajax.php?page=ajax-search-pro/backend/settings.php&action=wpdreams-ajaxinput With POST data: wpdreams_callback=wp_insert_user&user_login=xADMIN&us...
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free