plugin
13 known security issues reported for the Ajax Search Pro WordPress plugin. Most recent disclosed Apr 24, 2023.
Running Ajax Search Pro on your site? Check whether your installed version is affected.
Scan your site free[en] The Ajax Search Pro WordPress plugin before 4.26.2 does not sanitise and escape various parameters before outputting them back in pages, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
[en] The Ajax Search Lite WordPress plugin before 4.11.1, Ajax Search Pro WordPress plugin before 4.26.2 does not sanitise and escape a parameter before outputting it back in a response of an AJAX action, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
The Ajax Search Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via some of its parameters in versions up to, and including, 4.26.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that exe...
The Ajax Search Pro plugin for WordPress is vulnerable to SQL Injection via the ‘p_blogid’ parameter in versions up to, and including, 4.18.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with...
The Ajax Search Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.18.7. This is due to missing or incorrect nonce validation in one of its functions. This makes it possible for unauthenticated attackers to invoke the vulnerable function via a forged request granted...
The Ajax Search Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.18.7. This is due to missing or incorrect nonce validation in one of its functions. This makes it possible for unauthenticated attackers to invoke the vulnerable function via a forged request granted...
The Ajax Search Pro plugin for WordPress is vulnerable to SQL Injection via the ‘p_blogid’ parameter in versions up to, and including, 4.18.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with...
The Ajax Search Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5. This is due to missing or incorrect nonce validation on the 'wpdreams_ajaxinputcallback' function. This makes it possible for unauthenticated attackers to execute any arbitrary function via a forg...
Because of this vulnerability, any registered user to execute any function he wants with 1st param set to array($_POST). Update the plugin.
The Ajax Search Pro plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5. This is due to missing or incorrect nonce validation on the 'wpdreams_ajaxinputcallback' function. This makes it possible for unauthenticated attackers to execute any arbitrary function via a forg...
The ajax-search-pro WordPress plugin was affected by a Cross-Site Request Forgery (CSRF) Add User security vulnerability.
The plugin does not properly escape user input as it gets into an SQL query in certain AJAX actions.
The plugin does not properly sanitize and escape user input before printing it back into the administration panel.
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free