WordPress Plugin Vulnerabilities

AI Search Bar <= 2.1 - Unauthenticated Stored Cross-Site Scripting

Description

The AI Search Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 2.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
open-ai-search-bar
No known fix

References

CVE
CVE-2025-31563
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/5b62aa7d-740f-447f-9086-5bc8286bc030

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
stealthcopter
Verified
No
WPVDB ID
9e47fca8-ebad-4984-8c6c-869ac940900f

Timeline

Publicly Published
2025-04-01 (about 11 months ago)
Added
2025-04-09 (about 11 months ago)
Last Updated
2025-05-21 (about 9 months ago)

Other

Published
Title
Published
2023-11-14
Title
Website Optimization – Plerdy < 1.3.3 - Authenticated (Admin+) Stored Cross-Site Scripting
Published
2023-12-01
Title
Seraphinite Accelerator < 2.20.29 - Reflected Cross-Site Scripting via rt
Published
2023-02-16
Title
Portfolio - WordPress Portfolio < 2.8.11 - Contributor+ Stored XSS
Published
2014-08-01
Title
wpcb 2.4.8 - facture.php id Parameter Reflected XSS
Published
2022-07-18
Title
DW Promobar <= 1.0.4 - Admin+ Stored Cross-Site Scripting