CVE-2026-96553
HighCVSS 7.1Summary
A Reflected Cross-Site Scripting (XSS) vulnerability in the FiboSearch plugin for WordPress, affecting versions up to 1.34.1, allows an attacker to inject malicious scripts into the page.
Risk Assessment
An attacker can steal user data, hijack sessions, or perform other malicious actions in the context of the victim's browser.
Recommendation
Update the FiboSearch plugin to a version newer than 1.34.1 that includes the XSS fix.
Other vulnerabilities in FiboSearch
See all- CVE-2026-16612Medium
The FiboSearch WordPress plugin before version 1.34.1 does not consistently exclude password-protected products from its unauthenticated AJAX endpoints. This allows unauthenticated users to disclose and enumerate password-protected products and their metadata without entering the product password. Two endpoints are affected: the autocomplete search endpoint (dgwt_wcas_ajax_search) and the Details Panel endpoint (dgwt_wcas_result_details) when queried for taxonomy details.
- CVE-2026-28179Medium
Cross Site Scripting (XSS) vulnerability in FiboSearch versions up to 1.33.0 allows a Shop manager user to inject malicious script.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Damian Góra FiboSearch ajax-search-for-woocommerce allows Reflected XSS.This issue affects FiboSearch: from n/a through 1.34.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS