The YITH WooCommerce Ajax Search plugin for WordPress versions up to 2.4.0 suffers from a stored cross-site scripting vulnerability (CWE-79) via the 'item' parameter. Due to inadequate input sanitization and output escaping, unauthenticated attackers can inject arbitrary web scripts that persist and execute in users' browsers when they visit the affected pages. This vulnerability has a CVSS 3.1 base score of 7.2, reflecting its network attack vector, low attack complexity, no privileges required, no user interaction needed, and impacts on confidentiality and integrity with scope change.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of users visiting the affected pages. This can lead to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality and integrity. There is no impact on availability reported. No known exploits in the wild have been documented at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the affected plugin or parameter to mitigate risk. Monitor official yithemes communications for updates and apply patches promptly once released.