CVE-2023-2450

The FiboSearch - AJAX Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in versions up to, and including, 1.23.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

• https://plugins.trac.wordpress.org/browser/ajax-search-for-woocommerce/tags/1.23.0/includes/Helpers.php#L1229Patch
• https://plugins.trac.wordpress.org/changeset?old_path=%2Fajax-search-for-woocommerce%2Ftags%2F1.23.0&old=2917453&new_path=%2Fajax-search-for-woocommerce%2Ftags%2F1.24.0&new=2917453&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/880573d8-6dad-4a1b-a5db-33e1dc243062?source=cveThird Party Advisory
• https://plugins.trac.wordpress.org/browser/ajax-search-for-woocommerce/tags/1.23.0/includes/Helpers.php#L1229Patch
• https://plugins.trac.wordpress.org/changeset?old_path=%2Fajax-search-for-woocommerce%2Ftags%2F1.23.0&old=2917453&new_path=%2Fajax-search-for-woocommerce%2Ftags%2F1.24.0&new=2917453&sfp_email=&sfph_mail=Patch
• https://www.wordfence.com/threat-intel/vulnerabilities/id/880573d8-6dad-4a1b-a5db-33e1dc243062?source=cveThird Party Advisory

Published

Jun 9, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-24494A stored cross-site scripting (XSS) vulnerability exists in …5.4
• CVE-2023-24495A Server Side Request Forgery (SSRF) vulnerability exists in…6.5
• CVE-2023-24496Cross-site scripting (xss) vulnerabilities exist in the requ…4.7
• CVE-2023-24497Cross-site scripting (xss) vulnerabilities exist in the requ…4.7
• CVE-2023-24498An uspecified endpoint in the web server of the switch does …7.5
• CVE-2023-24499Butterfly Button plugin may leave traces of its use on user'…4.6
• CVE-2023-24500Electra Central AC unit – Adjacent attacker may cause the un…6.5
• CVE-2023-24501Electra Central AC unit – Hardcoded Credentials in unspecifi…9.8
• CVE-2023-24502Electra Central AC unit – The unit opens an AP with an easil…6.5
• CVE-2023-24503Electra Central AC unit – Adjacent attacker may cause the un…6.5
• CVE-2023-24504Electra Central AC unit – Adjacent attacker may cause the un…6.5
• CVE-2023-24505 Milesight NCR/camera version 71.8.0.6-r5 discloses sensitiv…7.5