CVE-2026-15301

Name of the Vulnerable Software and Affected Versions BuddyHolis TableSearch versions prior to 1.1.1

Description Insufficient input sanitization and output escaping allow authenticated attackers with Contributor-level access and above to perform Stored Cross-Site Scripting. This is achieved by injecting arbitrary web scripts via the placeholder parameter, which then execute when a user visits the affected page.

Recommendations Update BuddyHolis TableSearch to a version newer than 1.1.0. Avoid using the placeholder parameter until the update is applied.