Stored Cross-Site Scripting Vulnerability in SearchIQ Plugin for WordPress
CVE-2024-13350

6.4MEDIUM

Key Information:

Vendor
Searchiq
Status
Searchiq – The Search Solution
Vendor
CVE Published:
5 March 2025

Summary

The SearchIQ plugin for WordPress has a vulnerability that exposes it to Stored Cross-Site Scripting (XSS). This issue arises from inadequate input sanitization and output escaping within the 'siq_searchbox' shortcode across all versions up to 4.7. Authenticated attackers with contributor-level access can exploit this flaw to inject malicious scripts into pages. When other users access these compromised pages, the malicious scripts will execute, potentially leading to data theft or website compromise.

Affected Version(s)

SearchIQ – The Search Solution * <= 4.7

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/searchiq/trunk...
https://wordpress.org/plugins/searchiq

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Djaidja Moundjid
.