CVE-2026-28179
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
Cross Site Scripting (XSS) vulnerability in FiboSearch versions up to 1.33.0 allows a Shop manager user to inject malicious script.
Risk Assessment
Malicious script can be executed in other users' browsers, potentially leading to session theft or account takeover.
Recommendation
Update the FiboSearch plugin to the latest version that includes the security fix.
Other vulnerabilities in FiboSearch
See all- CVE-2026-96553High
A Reflected Cross-Site Scripting (XSS) vulnerability in the FiboSearch plugin for WordPress, affecting versions up to 1.34.1, allows an attacker to inject malicious scripts into the page.
- CVE-2026-16612Medium
The FiboSearch WordPress plugin before version 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints. This allows unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two endpoints are affected: the autocomplete search endpoint (dgwt_wcas_ajax_search) and the Details Panel endpoint (dgwt_wcas_result_details) when queried for taxonomy details.
Original NVD description (English source)
Shop manager Cross Site Scripting (XSS) in FiboSearch <= 1.33.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS