Vulnerabilities

TI-2025-20880 CVE-2025-28937 · GHSA-52r6-v45h-gh94

WordPress Lava Ajax Search plugin <= 1.1.9 - Cross Site Scripting (XSS) vulnerability

LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in lavacode Lava Ajax Search lava-ajax-search allows Stored XSS.This issue affects Lava Ajax Search: from n/a through <=…

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.00286 Published 2025-03-11 No fix listed CWE-79

TI-2023-25799 CVE-2023-47659 · GHSA-6mgm-5jqv-4w32

WordPress Lava Directory Manager Plugin <= 1.1.34 is vulnerable to Cross Site Scripting (XSS)

LOW 29

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Lavacode Lava Directory Manager plugin <= 1.1.34 versions.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00385 Published 2023-11-14 No fix listed CWE-79

TI-2023-24734 CVE-2023-46081 · GHSA-gc74-6h94-8cfj

WordPress Lava Directory Manager Plugin <= 1.1.34 is vulnerable to Cross Site Scripting (XSS)

LOW 31

Unauth. Stored Cross-Site Scripting (XSS) vulnerability in Lavacode Lava Directory Manager plugin <= 1.1.34 versions.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00382 Published 2023-10-26 No fix listed CWE-79

Vulnerabilities

Filters

WordPress Lava Ajax Search plugin <= 1.1.9 - Cross Site Scripting (XSS) vulnerability

WordPress Lava Directory Manager Plugin <= 1.1.34 is vulnerable to Cross Site Scripting (XSS)

WordPress Lava Directory Manager Plugin <= 1.1.34 is vulnerable to Cross Site Scripting (XSS)