CVE-2026-96553: WordPress FiboSearch plugin <= 1.34.1 - Cross Site Scripting (XSS) vulnerability

Q: What attacker interaction is required to exploit this issue?

The vulnerability is reflected XSS and requires user interaction. The supplied vector indicates network-reachable exploitation with low complexity and no privileges required, but a victim must interact with attacker-controlled content or a crafted request.

Q: Which FiboSearch versions are affected?

FiboSearch versions through 1.34.1 are affected. The lower bound is listed as unspecified.

Q: What is the potential impact if exploitation succeeds?

The provided CVSS vector indicates low confidentiality, integrity, and availability impact, with scope changed. Successful XSS can cause effects in the context of the affected web page after a victim interacts with the exploit.

Published Oct 9, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Damian Góra FiboSearch ajax-search-for-woocommerce allows Reflected XSS.This issue affects FiboSearch: from n/a through 1.34.1.

Affected Software

1 affected component

Damian Góra FiboSearch<=1.34.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress FiboSearch to a version that resolves this vulnerability.
Fixed in 1.34.2

Event History

Oct 9, 2026

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What attacker interaction is required to exploit this issue?

The vulnerability is reflected XSS and requires user interaction. The supplied vector indicates network-reachable exploitation with low complexity and no privileges required, but a victim must interact with attacker-controlled content or a crafted request.

Which FiboSearch versions are affected?

FiboSearch versions through 1.34.1 are affected. The lower bound is listed as unspecified.

What is the potential impact if exploitation succeeds?

The provided CVSS vector indicates low confidentiality, integrity, and availability impact, with scope changed. Successful XSS can cause effects in the context of the affected web page after a victim interacts with the exploit.

CVE-2026-96553: WordPress FiboSearch plugin <= 1.34.1 - Cross Site Scripting (XSS) vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

What attacker interaction is required to exploit this issue?

Which FiboSearch versions are affected?

What is the potential impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What attacker interaction is required to exploit this issue?

Which FiboSearch versions are affected?

What is the potential impact if exploitation succeeds?