Site Search 360 Vulnerabilities

The Site Search 360 plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.1.7. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to update settings and inject malicious web scripts via a forged requ...

CVSS:

6.1

Affected:

up to 2.1.7

Fix:

No patched version reported

Disclosed:

Apr 16, 2025

CVE-2025-39530 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in dsky Site Search 360 allows Stored XSS. This issue affects Site Search 360: from n/a through 2.1.7.

Affected:

up to 2.1.7

Fix:

No patched version reported

Disclosed:

Apr 16, 2025

CVE-2025-39530 on NVD →

[en] The Site Search 360 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ss360-resultblock' shortcode in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers...

Affected:

up to 2.1.7

Fixed in:

2.1.7

Disclosed:

Feb 1, 2025

CVE-2024-11780 on NVD →

The Site Search 360 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'ss360-resultblock' shortcode in all versions up to, and including, 2.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, wit...

CVSS:

6.4

Affected:

up to 2.1.6

Fixed in:

2.1.7

Disclosed:

Jan 31, 2025

CVE-2024-11780 on NVD →