CVE-2026-95598: WordPress Search in Place plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople Search in Place search-in-place allows Reflected XSS.This issue affects Search in Place: from n/a through 1.5.5.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Search in Place pluginto a version that resolves this vulnerability.Fixed in 1.5.6
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The CVSS vector indicates exploitation can be performed over the network with low attack complexity and requires no attacker privileges, but it requires user interaction. The issue is reflected XSS, so exploitation depends on getting a user to interact with a crafted request or link.
What is the potential impact if exploitation succeeds?
The reported CVSS vector indicates low impact to confidentiality, integrity, and availability, with scope changed. Successful XSS may allow attacker-controlled script to run in the affected web page context after a user interacts with the malicious input.
Which plugin versions are affected?
Search in Place versions through 1.5.5 are affected. The available data does not identify a fixed version.