SearchWP Live Ajax Search < 1.6.2 - Unauthenticated Arbitrary Post Title Disclosure

The plugin does not ensure that users making. alive search are limited to published posts only, allowing unauthenticated users to make a crafted query disclosing private/draft/pending post titles along with their permalink id: CVE-2022-2535 info: name: SearchWP Live Ajax Search 1.6.2 -...

WordPress Ajax Search Pro plugin <= 4.29.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Rafie Muhammad in WordPress Plugin Ajax Search Pro versions = 4.29.1...

CVE-2026-96352

Unauthenticated Cross Site Scripting XSS in YITH WooCommerce Ajax Search = 2.28.0 versions...

CVE-2026-96352 WordPress YITH WooCommerce Ajax Search plugin <= 2.28.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in YITH WooCommerce Ajax Search = 2.28.0 versions...

CVE-2026-96352

The YITH WooCommerce Ajax Search plugin for WordPress, versions

EUVD-2026-89865

Unauthenticated Cross Site Scripting XSS in YITH WooCommerce Ajax Search = 2.28.0 versions...

CVE-2026-96352 WordPress YITH WooCommerce Ajax Search plugin <= 2.28.0 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in YITH WooCommerce Ajax Search = 2.28.0 versions...

CVE-2026-96352: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in YITH WooCommerce Ajax Search = 2.28.0 versions...

PT-2026-103197

Unauthenticated Cross Site Scripting XSS in YITH WooCommerce Ajax Search = 2.28.0 versions...

WordPress YITH WooCommerce Ajax Search plugin <= 2.28.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Dthangws in WordPress Plugin YITH WooCommerce Ajax Search versions = 2.28.0...

WordPress Ajax Search Lite plugin < 4.14.5 - Unauthenticated PHP Object Injection via Search Statistics REST Endpoint vulnerability

Unauthenticated PHP Object Injection via Search Statistics REST Endpoint vulnerability discovered by Jakub Herman in WordPress Plugin Ajax Search Lite versions 4.14.5...

WordPress Ajax Search Lite PHP Object Injection Vulnerability

WordPress Ajax Search Lite is a free WordPress plugin developed by wpdreams. It provides a real-time search experience where results are displayed immediately upon input. This plugin can replace the default search function and supports customization of content types and fields. However, WordPress...

CVE-2026-16258

The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can...

CVE-2026-16258 Ajax Search Lite < 4.14.5 - Unauthenticated PHP Object Injection via Search Statistics REST Endpoint

The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can...

CVE-2026-16258

The Ajax Search Lite WordPress plugin (versions before 4.14.5 ) is vulnerable to PHP Object Injection due to the insecure deserialization of untrusted input. This flaw is specifically located in the Search Statistics REST Endpoint . An unauthenticated attacker can exploit this to achieve Remote C...

EUVD-2026-54389

The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can...

PT-2026-68870

Name of the Vulnerable Software and Affected Versions Ajax Search Lite versions prior to 4.14.5 Description An issue exists where the software fails to prevent the deserialization of untrusted input, enabling unauthenticated attackers to perform PHP Object Injection. This occurs via the Search...

CVE-2026-16258: Deserialization of Untrusted Data

The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can...

CVE-2026-28139

Unauthenticated PHP Object Injection in Ajax Search Lite = 4.14.4 versions...

CVE-2026-28139

CVE-2026-28139 concerns the WordPress plugin Ajax Search Lite (vulnerable: ≤ 4.14.4). The issue is an unauthenticated PHP Object Injection in the plugin’s handling of objects, as described in CVE details and corroborated by multiple feeds. Affected component: the Ajax Search Lite plugin; root cau...