CVE-2026-125761mediumCWE-79

CVE-2026-125761: medium-severity vulnerability in YITH WooCommerce Ajax Search

WordPress YITH WooCommerce Ajax Search plugin <= 2.30.0 - Cross Site Scripting (XSS) vulnerability

Published 11 Nov 2026

Follow this CVE + Monitor YITH WooCommerce Ajax Search

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

10Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH WooCommerce Ajax Search yith-woocommerce-ajax-search allows Stored XSS.This issue affects YITH WooCommerce Ajax Search: from n/a through 2.30.0.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L

Affected products

YITH · YITH WooCommerce Ajax Search

References

https://patchstack.com/database/wordpress/plugin/yith-woocommerce-ajax-search/vulnerability/wordpress-yith-woocommerce-ajax-search-plugin-2-30-0-cross-site-scripting-xss-vulnerability?_s_id=cve