WordPress Plugin Vulnerabilities

Advance Search < 1.1.3 - Reflected Cross-Site Scripting

Description

The plugin is vulnerable to Reflected Cross-Site Scripting via the wpas_id parameter found in the ~/inc/admin/views/html-advance-search-admin-options.php file which allows attackers to inject arbitrary web scripts.

Affects Plugins

Plugin icon
advance-search
Fixed in 1.1.3

References

CVE
CVE-2021-38348
URL
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-38348

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Original Researcher
p7e4
Verified
Yes
WPVDB ID
c48f1a59-7e21-4d7f-9014-c119f671af8f

Timeline

Publicly Published
2021-09-09 (about 4 years ago)
Added
2021-09-10 (about 4 years ago)
Last Updated
2022-04-26 (about 4 years ago)

Other

Published
Title
Published
2015-11-24
Title
Contact Form Manager <= 1.4.1 - Authenticated Reflected Cross-Site Scripting (XSS)
Published
2025-04-16
Title
WP Posts Carousel < 1.3.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2023-04-18
Title
Button Builder - Buttons X <= 0.8.6 - Contributor+ Stored XSS
Published
2026-02-04
Title
Dynamic Widget Content < 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Content Field
Published
2021-07-14
Title
Current Book <= 1.0.1 - Authenticated Stored Cross-Site Scripting (XSS)