Threat database

CVE-2026-96553 is a reflected cross-site scripting (XSS) vulnerability in the FiboSearch plugin for WooCommerce by Damian Góra. It affects versions from the initial release up to 1.34.1. The flaw allows improper neutralization of input during web page generation, potentially enabling attackers to inject malicious scripts that execute in users' browsers. The vulnerability has a high severity rating with a CVSS score of 7.1.

CVE-2026-28179 is a medium severity Cross-Site Scripting (XSS) vulnerability affecting FiboSearch versions up to and including 1.33.0. It involves improper neutralization of input during web page generation, allowing a shop manager level user to potentially inject malicious scripts. The vulnerability has a CVSS score of 5.9 and impacts confidentiality, integrity, and availability to a limited extent. No official patch or remediation guidance has been provided by the vendor yet.

Missing Authorization vulnerability in Damian Góra FiboSearch ajax-search-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FiboSearch: from n/a through <= 1.32.1.