plugin
19 known security issues reported for the Wp Advanced Search WordPress plugin. Most recent disclosed Apr 16, 2025.
Running Wp Advanced Search on your site? Check whether your installed version is affected.
Scan your site freeThe WordPress WP-Advanced-Search plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in all versions up to, and including, 3.3.9.3. This makes it possible for authenticated attackers, with Administrator-level access and above, to upload arbitrary files on the affected site's...
[en] Unrestricted Upload of File with Dangerous Type vulnerability in Mathieu Chartier WP-Advanced-Search allows Upload a Web Shell to a Web Server. This issue affects WP-Advanced-Search: from n/a through 3.3.9.3.
[en] The WordPress WP-Advanced-Search WordPress plugin before 3.3.9.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
The WordPress WP-Advanced-Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 3.3.9.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and abo...
[en] The WP-Advanced-Search WordPress plugin before 3.3.9.2 does not sanitize and escape the t parameter before using it in a SQL statement, allowing unauthenticated users to perform SQL injection attacks
The WordPress WP-Advanced-Search plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.3.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append addit...
[en] Cross-Site Request Forgery (CSRF) vulnerability in Mathieu Chartier WordPress WP-Advanced-Search plugin <= 3.3.8 versions.
The WP-Advanced-Search plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.3.8. This is due to missing or incorrect nonce validation on the 'WP_Advanced_Search_update_pagination', 'WP_Advanced_Search_update_styles', 'WP_Advanced_Search_Autocomplete_Action, and possibly o...
[en] The Import feature in the wp-advanced-search plugin 3.3.6 for WordPress is vulnerable to authenticated SQL injection via an uploaded .sql file. An attacker can use this to execute SQL commands without any validation.
The Import feature in the wp-advanced-search plugin 3.3.6 for WordPress is vulnerable to authenticated SQL injection via an uploaded .sql file. An attacker can use this to execute SQL commands without any validation.
Authenticated SQL Injection (SQLi) vulnerability found by Nawaf Alkeraithe and Hashim Alshareef in WordPress WP-Advanced-Search plugin (versions <= 3.3.3).
Unauthenticated SQL Injection (SQLi) vulnerability discovered by Florian Hauser in WordPress WP-Advanced-Search plugin (versions <= 3.3.3).
The WordPress WP-Advanced-Search plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.3.3 via the WP_Advanced_Search_Import() function which makes it possible for unauthenticated attackers to execute code on the server through a file upload. This is due to the WP_Advanced_Sear...
The WordPress WP-Advanced-Search plugin for WordPress is vulnerable to unauthenticated database export in versions up to, and including, 3.3.3 via the WP_Advanced_Search_Export() function which makes it possible for unauthenticated attackers to export a vulnerable site's entire database. This is due to the WP_Advanced_...
Unauthenticated Database Access vulnerability discovered by Florian Hauser in WordPress WP-Advanced-Search plugin (versions <= 3.3.3).
The WordPress WP-Advanced-Search plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.3.3 via the WP_Advanced_Search_Import() function which makes it possible for unauthenticated attackers to execute code on the server through a file upload. This is due to the WP_Advanced_Sear...
The WordPress WP-Advanced-Search plugin for WordPress is vulnerable to unauthenticated database export in versions up to, and including, 3.3.3 via the WP_Advanced_Search_Export() function which makes it possible for unauthenticated attackers to export a vulnerable site's entire database. This is due to the WP_Advanced_...
Due to using string concatenation, allowing direct access to a vulnerable PHP file and missing best-practices for coding SQL operations, there exists an unauthenticated SQL injection in autocompletion-PHP5.5.php. After a month of trying to contact the Plugin author (Twitter, email), we followed generally accepted di...
Arbitrary database queries can be executed in an unauthenticated context of the "WP-Advanced-Search Plugin". E.g. a new administrative account could be added to the WordPress instance, a malicious plugin deployed and therefore Remote Code Execution (RCE) would be possible in the end.
Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.
Scan your site free