Description

Shop manager Cross Site Scripting (XSS) in FiboSearch <= 1.33.0 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-06T15:16:53.800Z",
  "pubdate": "2026-08-06T15:16:53.800Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists in the FiboSearch plugin for versions up to and including 1.33.0. The vulnerability is specifically categorized as a Shop Manager Cross-Site Scripting flaw, which allows authenticated users with specific shop management capabilities to inject and execute arbitrary client-side scripts within the context of the administrative or management interface.\nThe primary impact of this security deficiency involves the potential compromise of user sessions, unauthorized execution of administrative actions, and the exposure of sensitive application data. The affected product is FiboSearch, impacting all installations running version 1.33.0 or earlier.\nThe risk implications are moderate to high depending on the privileges of the targeted user and the sensitivity of the environment. An attacker capable of exploiting this vulnerability must possess specific access levels or trick an authenticated user with shop manager privileges into interacting with crafted inputs.\nExploitation requirements include authentication and the ability to supply malicious input fields that are subsequently rendered without adequate output encoding or sanitization. Attack capabilities center around DOM-based or stored execution of JavaScript payloads within the administrative dashboard.",
  "technicalDetails": "The vulnerability stems from insufficient input sanitization and output encoding within the FiboSearch plugin functionality accessible or managed by shop managers. Specifically, parameters supplied via the administrative or management interface are improperly validated before being reflected back to the user or stored within the database.\nThe root cause is a failure in the application logic to properly neutralize special characters, such as angle brackets and quotation marks, enabling the injection of HTML and JavaScript payloads. The vulnerable component resides within the codebase handling shop manager configurations and search settings in FiboSearch versions <= 1.33.0.\nAuthentication and privilege requirements dictate that the actor must either hold a role equivalent to a shop manager or successfully leverage a secondary vector, such as Cross-Site Request Forgery, to force an authorized user to execute the malicious payload. Network exposure is localized to the web application interface where the FiboSearch management functionality is exposed.\nThe step-by-step attack flow proceeds as follows: First, the malicious actor crafts a specialized payload containing arbitrary JavaScript designed to execute within the victim browser session. Second, the attacker inputs this payload into a vulnerable parameter within the FiboSearch settings or management interface. Third, the application accepts the input and persists it or reflects it inadequately sanitized. Fourth, when an authenticated shop manager or administrator views the affected interface, the browser parses the payload as executable code rather than plain text.\nPayload behavior involves executing in the security context of the victim session, allowing the script to access Document Object Model (DOM) elements, read session cookies if not protected by HttpOnly flags, and perform unauthorized actions on behalf of the user. Post-exploitation impact includes privilege escalation, unauthorized modification of plugin configurations, and potential pivot vectors targeting broader WordPress administrative capabilities."
}