WordPress Plugin Vulnerabilities

Better Search < 1.3.5 - Reflected Cross-Site Scripting (XSS)

Description

By submitting the JavaScript below to the search field Reflected Cross-Site Scripting (XSS) is possible.

<script>alert(String.fromCharCode(80, 97, 103, 101, 32, 118, 117, 108, 110, 101, 114, 97, 98, 108, 101, 32, 116, 111, 32, 114, 101, 102, 108, 101, 99, 116, 105, 118, 101, 32, 88, 83, 83))</script>

Affects Plugins

Plugin icon
better-search
Fixed in 1.3.5

References

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.1 (medium)

Miscellaneous

Submitter
Juan Avila Reyes
Verified
No
WPVDB ID
ccdf450b-8121-44b2-978a-c764a51e1cf7

Timeline

Publicly Published
2014-12-16 (about 11 years ago)
Added
2014-12-16 (about 11 years ago)
Last Updated
2021-02-12 (about 5 years ago)

Other

Published
Title
Published
2025-10-21
Title
Responsive iframe GoogleMap <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Published
2025-03-18
Title
Site Editor Google Map <= 1.0.1 - Reflected Cross-Site Scripting
Published
2026-02-11
Title
Duplicate Post < 3.2.4 - Admin+ Stored XSS
Published
2024-08-26
Title
Tempera <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2022-07-18
Title
WP OAuth2 Server <= 1.0.1 - Authentication Bypass