CVE-2026-95598: WordPress Search in Place plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability

Q: What does an attacker need to exploit this issue?

The CVSS vector indicates exploitation can be performed over the network with low attack complexity and requires no attacker privileges, but it requires user interaction. The issue is reflected XSS, so exploitation depends on getting a user to interact with a crafted request or link.

Q: What is the potential impact if exploitation succeeds?

The reported CVSS vector indicates low impact to confidentiality, integrity, and availability, with scope changed. Successful XSS may allow attacker-controlled script to run in the affected web page context after a user interacts with the malicious input.

Q: Which plugin versions are affected?

Search in Place versions through 1.5.5 are affected. The available data does not identify a fixed version.

Published Oct 9, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Search in Place search-in-place allows Reflected XSS.This issue affects Search in Place: from n/a through 1.5.5.

Affected Software

1 affected component

CodePeople Search in Place<=1.5.5

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress Search in Place plugin to a version that resolves this vulnerability.
Fixed in 1.5.6

Event History

Oct 9, 2026

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

The CVSS vector indicates exploitation can be performed over the network with low attack complexity and requires no attacker privileges, but it requires user interaction. The issue is reflected XSS, so exploitation depends on getting a user to interact with a crafted request or link.

What is the potential impact if exploitation succeeds?

The reported CVSS vector indicates low impact to confidentiality, integrity, and availability, with scope changed. Successful XSS may allow attacker-controlled script to run in the affected web page context after a user interacts with the malicious input.

Which plugin versions are affected?

Search in Place versions through 1.5.5 are affected. The available data does not identify a fixed version.

CVE-2026-95598: WordPress Search in Place plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the potential impact if exploitation succeeds?

Which plugin versions are affected?