YITH WooCommerce Ajax Search: Stored cross-site scripting (XSS)
Summary
The WordPress plugin YITH WooCommerce Ajax Search up to and including version 2.30.0 contains a stored cross-site scripting (XSS) vulnerability (CWE-79). An attacker with a low-privileged account on the site can store malicious script code that runs in the browser of another user who views the affected content. Successful exploitation requires that a privileged user performs an action, such as clicking a malicious link or visiting a crafted page.
Affected
- YITH WooCommerce Ajax Search plugin, all versions up to and including 2.30.0
- Required privilege: low (reported as Contributor, not confirmed by the CVE record)
Fixed in
- Version 2.30.1 (according to the Patchstack advisory and the CVE record; not yet confirmed on wordpress.org or in the vendor changelog)
Workaround
- None confirmed by the vendor.
- If an update is not possible, disable the plugin if it is not essential and restrict who can create content or accounts.
Exploitation
- Not known to be exploited as of 11 November 2026 according to one aggregator; not listed in KEV.
- No public proof of concept found.
Our recommendation
- Check whether the WooCommerce shop runs YITH WooCommerce Ajax Search and which version is installed.
- Update to version 2.30.1 or later once the fixed version is confirmed on wordpress.org or the vendor changelog.
- Review accounts with contributor or higher roles and remove unneeded ones.
- Monitor site content and logs for unexpected scripts.
- Prioritise the update if the site allows self-registration or has multiple author roles.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory CVE-2026-125761 patchstack.com
- OffSeq radar summary CVE-2026-125761 radar.offseq.com
- Strix CVE-2026-125761 www.strix.ai
- wordpress.org plugin changelog wordpress.org
- WPScan plugin page wpscan.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 13:37.
Original description (NVD)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Ajax Search yith-woocommerce-ajax-search allows Stored XSS.This issue affects YITH WooCommerce Ajax Search: from n/a through 2.30.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.