This vulnerability (CVE-2026-28179) is a CWE-79 Cross-Site Scripting issue in the FiboSearch plugin for e-commerce platforms, affecting versions up to 1.33.0. It allows a user with shop manager privileges to inject malicious scripts due to improper input sanitization during web page generation. The CVSS 3.1 base score is 5.9, reflecting network attack vector, low attack complexity, high privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability. No vendor advisory or patch information is currently provided.

An attacker with shop manager privileges can exploit this XSS vulnerability to execute arbitrary scripts in the context of affected users, potentially leading to data disclosure, modification, or disruption of service. The impact affects confidentiality, integrity, and availability to a limited extent as indicated by the CVSS vector. However, exploitation requires elevated privileges and user interaction, which limits the scope of impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict shop manager privileges to trusted users only and consider additional input validation or web application firewall rules to mitigate potential exploitation.