PT-2026-41392

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 2026.5 Description The live search preview renders the source and context variables as HTML without proper escaping. This allows a contributor to store HTML and CSS that executes within the authenticated editor of any...

PT-2025-6017 · Dreamvention · Dreamvention Live Ajax Search

Name of the Vulnerable Software and Affected Versions: Dreamvention Live AJAX Search Free versions 1.0.0 through 1.0.6 Description: A critical issue has been found in the function searchresults/search of the file /?route=extension/live search/module/live search.searchresults. The manipulation of...

Code Injection

elektra is vulnerable to Code Injection. The vulnerability is due to improper handling of user input in the live search functionality of the Ruby on Rails-based Elektra web application, which allows authenticated users to craft a search term containing Ruby code that flows into an eval call,...

CVE-2024-41961

Summary of CVE-2024-41961 (Elektra) : Elektra, a Ruby on Rails-based OpenStack dashboard, contains a code injection vulnerability in its live search functionality. An authenticated user can provide a search term that includes Ruby code, which flows to an eval sink and can execute arbitrary code. ...

WordPress Dave's WordPress Live Search Plugin <= 4.8.1 is vulnerable to Cross Site Scripting (XSS)

Software Dave's WordPress Live Search Type Plugin Vulnerable versions = 4.8.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-30876 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID b8da8e543141 Credits Yuki Haruma...

WordPress Ajax Live Search Plugin For WordPress plugin <= 2.3.7 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Ajax Live Search Plugin For WordPress plugin versions = 2.3.7. Solution No patched version available...

WordPress Ajax Live Search Plugin For WordPress plugin <= 2.3.7 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Ajax Live Search Plugin For WordPress plugin versions = 2.3.7. Solution No patched version available...

Dave's WordPress Live Search <= 4.5 - Reflected Cross-Site Scripting (XSS)

From changelog: "Fixed cross-site scripting vulnerability in unsanitized "tab" parameter on admin pages"...