CVE-2025-14298

🗓️ 20 Dec 2025 08:22:10Reported by WordfenceType

Stored XSS in FiboSearch via thegem_te_search; requires TheGem with Header Builder and Replace search bars enabled.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2025-14298	20 Dec 202510:53	–	circl
CNNVD	WordPress plugin FiboSearch 跨站脚本漏洞	20 Dec 202500:00	–	cnnvd
Cvelist	CVE-2025-14298 FiboSearch – Ajax Search for WooCommerce <= 1.32.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via thegem_te_search Shortcode	20 Dec 202508:22	–	cvelist
EUVD	EUVD-2025-204637	20 Dec 202509:31	–	euvd
NVD	CVE-2025-14298	20 Dec 202509:15	–	nvd
Patchstack	WordPress FiboSearch – Ajax Search for WooCommerce plugin <= 1.32.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via thegem_te_search Shortcode vulnerability	19 Dec 202523:05	–	patchstack
Positive Technologies	PT-2025-52549	20 Dec 202500:00	–	ptsecurity
RedhatCVE	CVE-2025-14298	21 Dec 202509:12	–	redhatcve
Vulnrichment	CVE-2025-14298 FiboSearch – Ajax Search for WooCommerce <= 1.32.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via thegem_te_search Shortcode	20 Dec 202508:22	–	vulnrichment
Wordfence Blog	Wordfence Intelligence Weekly WordPress Vulnerability Report (December 15, 2025 to January 4, 2026)	8 Jan 202618:20	–	wordfence

Vulners

Node

damian-gora fibosearch_ajax_search_for_woocommerceRange≤1.32.0wordpress

[
  {
    "vendor": "damian-gora",
    "product": "FiboSearch – Ajax Search for WooCommerce",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "1.32.0",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
wordpress	www.wordpress.org/plugins/ajax-search-for-woocommerce
plugins	www.plugins.trac.wordpress.org/changeset
plugins	www.plugins.trac.wordpress.org/browser/ajax-search-for-woocommerce/tags/1.32.0/partials/themes/thegem-elementor.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/8149103e-105d-401d-8a15-b07d131baaac
plugins	www.plugins.trac.wordpress.org/browser/ajax-search-for-woocommerce/tags/1.32.0/partials/themes/thegem-elementor.php

15 Apr 2026 00:35Current

4.7Medium risk

Vulners AI Score4.7

CVSS 3.15.4

EPSS0.00031

SSVC

CWE-79