CVE-2026-100106

Name of the Vulnerable Software and Affected Versions FiboSearch – Ajax Search for WooCommerce versions prior to 1.34.3

Description Insufficient input sanitization and output escaping allow authenticated attackers with subscriber-level access and above to perform Stored Cross-Site Scripting. This occurs via the purchased plan parameter when accessing the '/wp-admin/profile.php' endpoint. Exploitation is possible if the site owner has completed the standard Freemius opt-in flow, enabling the attacker to inject arbitrary web scripts that execute when a user visits the affected page.

Recommendations Update FiboSearch – Ajax Search for WooCommerce to a version newer than 1.34.2.