CVE-2026-100106: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in damian-gora FiboSearch – Ajax Search for WooCommerce

CVE-2026-100106 is a stored XSS vulnerability in the FiboSearch – Ajax Search for WooCommerce plugin for WordPress. The flaw arises from insufficient sanitization and escaping of the 'purchased_plan' parameter, allowing authenticated attackers with subscriber or higher privileges to inject arbitrary scripts. The vulnerability is triggered when visiting /wp-admin/profile.php with crafted query parameters, contingent on the site owner having completed the Freemius opt-in flow. This affects all versions up to and including 1.34.2.

An attacker with subscriber-level access can inject persistent malicious scripts that execute in the context of other users visiting the injected pages. This can lead to theft of user credentials, session hijacking, or other actions permitted by the victim's browser context. The vulnerability does not affect availability and requires authenticated access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level access where possible and monitor for suspicious activity related to the 'purchased_plan' parameter. Site owners should verify whether they have completed the Freemius opt-in flow, as this condition enables exploitation.