CVE-2026-100106: FiboSearch <= 1.34.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'purchased_plan' Parameter
The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'purchasedplan' parameter in all versions up to, and including, 1.34.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the site owner has previously completed the standard Freemius opt-in flow; once that condition is met, any Subscriber can reach the vulnerable handler simply by loading /wp-admin/profile.php with the requisite query parameters.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to exploitation?
A site is exposed if it runs FiboSearch version 1.34.2 or earlier and its owner has completed the standard Freemius opt-in flow. Without that prior opt-in, the described vulnerable handler is not reachable through this exploit path.
What access does an attacker need?
The attacker must be authenticated to WordPress with at least Subscriber-level access. They do not need user interaction to submit the payload: they can reach the handler by loading /wp-admin/profile.php with the required query parameters.
What is the practical impact if exploitation succeeds?
An attacker can store arbitrary web script that executes when another user accesses an injected page. The vulnerability affects confidentiality and integrity, while no availability impact is stated.