CVE-2026-125761: WordPress YITH WooCommerce Ajax Search plugin <= 2.30.0 - Cross Site Scripting (XSS) vulnerability

Q: What access does an attacker need to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges and requires user interaction. The attack can be performed remotely over the network with low complexity.

Q: What impact could successful exploitation have?

Successful stored XSS could affect confidentiality, integrity, and availability at low impact levels. The scope is changed, meaning the issue may affect components beyond the vulnerable plugin's own security authority.

Q: Which plugin versions are affected?

YITH WooCommerce Ajax Search versions through 2.30.0 are affected. The available data does not identify a fixed version.

Published Nov 11, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Ajax Search yith-woocommerce-ajax-search allows Stored XSS.This issue affects YITH WooCommerce Ajax Search: from n/a through 2.30.0.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade YITH WooCommerce Ajax Search to a version that resolves this vulnerability.
Fixed in 2.30.1

Event History

Nov 11, 2026

CVE Published

via MITRE·11:49 AM

Data Sourced

via MITRE·11:49 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·12:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The CVSS vector indicates that an attacker needs low-level privileges and requires user interaction. The attack can be performed remotely over the network with low complexity.

What impact could successful exploitation have?

Successful stored XSS could affect confidentiality, integrity, and availability at low impact levels. The scope is changed, meaning the issue may affect components beyond the vulnerable plugin's own security authority.

Which plugin versions are affected?