The Advanced Woo Search – Product Search for WooCommerce WordPress plugin suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input in the aws_search_terms shortcode. This allows authenticated users with contributor or higher privileges to inject arbitrary web scripts into pages, which execute upon page access by other users. The vulnerability affects all versions up to and including 3.28. The CVSS 3.1 base score is 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, required privileges, no user interaction, scope change, and limited confidentiality and integrity impact. A patch is available from the vendor.

An authenticated attacker with contributor-level or higher access can exploit this vulnerability to inject malicious scripts into pages via the aws_search_terms shortcode. These scripts execute in the context of users who view the infected pages, potentially leading to session hijacking, privilege escalation, or other malicious actions affecting confidentiality and integrity. Availability is not impacted. There are no known exploits in the wild at this time.

A patch is available to remediate this vulnerability. Users of the Advanced Woo Search plugin should update to the fixed version beyond 3.28 as soon as possible to mitigate the risk. Until patched, restrict contributor-level access to trusted users only and consider disabling or limiting use of the aws_search_terms shortcode to reduce exposure.