PT-2026-2831 · Searchwiz · Searchwiz

Athiwat Tiprasaharn + 6 · Published 2026-01-14 · Updated 2026-01-14 · CVE-2026-0694

Mitre

CVSS v3.1

6.4

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

The SearchWiz plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post titles in search results in all versions up to, and including, 1.0.0. This is due to the plugin using

esc attr()

instead of

esc html()

when outputting post titles in search results. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in post titles that will execute whenever a user performs a search and views the search results page.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-0694

Affected Products

Searchwiz

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-0694 · Security Note
• https://plugins.trac.wordpress.org/browser/searchwiz/trunk/public/class-sw-ajax.php#L616 · Note
• https://plugins.trac.wordpress.org/browser/searchwiz/tags/1.0.0/public/class-sw-ajax.php#L616 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/3e60a315-7f74-4d81-b6d2-ad3d40d489ef?source=cve · Note