Cross-site Scripting Vulnerability in CodeManas Search with Typesense
CVE-2025-49304

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Search With Typesense
Vendor
CVE Published:
6 June 2025

What is CVE-2025-49304?

The CodeManas Search with Typesense plugin for WordPress is susceptible to a Cross-site Scripting (XSS) vulnerability, allowing attackers to inject malicious scripts via user input. This can lead to the execution of arbitrary JavaScript in the context of authenticated users, potentially compromising sensitive information or hijacking user sessions. The vulnerability affects versions from n/a to 2.0.10.

Affected Version(s)

Search with Typesense <= 2.0.10

References

https://patchstack.com/database/wordpress/plugin/search-w...
vdb-entry

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

muhammad yudha (Patchstack Alliance)
.