Stored Cross-Site Scripting in FiboSearch Plugin for WooCommerce

CVE-2026-100106

What is CVE-2026-100106?

The FiboSearch – Ajax Search for WooCommerce plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability through the 'purchased_plan' parameter in all versions up to 1.34.2 due to inadequate input sanitization and output escaping measures. Authenticated attackers with subscriber-level access can exploit this flaw by injecting arbitrary web scripts that execute whenever a user accesses the affected pages. Successful exploitation requires the completion of the Freemius opt-in flow by the site owner, enabling any Subscriber to access the vulnerable handler via the /wp-admin/profile.php endpoint with the appropriate parameters.

References