Ricerca Smart Search Vulnerabilities

The Ricerca – advanced search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's settings in all versions up to, and including, 1.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and abov...

CVSS:

4.4

Affected:

up to 1.1.12

Fix:

No patched version reported

Disclosed:

Mar 20, 2026

CVE-2026-2837 on NVD →

The Ricerca smart and advanced search plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.15. This is due to missing or incorrect nonce validation on the saveSettings function. This makes it possible for unauthenticated attackers to change plugin settings via a forged...

CVSS:

4.3

Affected:

up to 1.0.15

Fixed in:

1.0.16

Disclosed:

May 16, 2023

The Ricerca smart and advanced search plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.15. This is due to missing or incorrect nonce validation on the saveSettings function. This makes it possible for unauthenticated attackers to change plugin settings via a forged...

Affected:

up to 1.0.16

Fixed in:

1.0.16

Disclosed:

May 16, 2023

Update the WordPress Ricerca – advanced search plugin to the latest available version (at least 1.0.16). WordFence discovered and reported this Cross Site Request Forgery (CSRF) vulnerability in WordPress Ricerca – advanced search Plugin. This could allow a malicious actor to force higher privileged users to execute un...

Affected:

up to 1.0.16

Fixed in:

1.0.16

Disclosed:

May 16, 2023