CVE-2025-14298

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14298", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-08T21:19:05.583Z", "datePublished": "2025-12-20T08:22:10.732Z", "dateUpdated": "2026-04-08T17:03:42.489Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:03:42.489Z"}, "affected": [{"vendor": "damian-gora", "product": "FiboSearch \u2013 Ajax Search for WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.32.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The FiboSearch \u2013 Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `thegem_te_search` shortcode in all versions up to, and including, 1.32.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability requires TheGem theme (premium) to be installed with Header Builder mode enabled, and the FiboSearch \"Replace search bars\" option enabled for TheGem integration."}], "title": "FiboSearch \u2013 Ajax Search for WooCommerce <= 1.32.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via thegem_te_search Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8149103e-105d-401d-8a15-b07d131baaac?source=cve"}, {"url": "https://wordpress.org/plugins/ajax-search-for-woocommerce"}, {"url": "https://plugins.trac.wordpress.org/browser/ajax-search-for-woocommerce/tags/1.32.0/partials/themes/thegem-elementor.php#L94"}, {"url": "https://plugins.trac.wordpress.org/browser/ajax-search-for-woocommerce/tags/1.32.0/partials/themes/thegem-elementor.php#L104"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3420841%40ajax-search-for-woocommerce%2Ftrunk&old=3398612%40ajax-search-for-woocommerce%2Ftrunk&sfp_email=&sfph_mail=#file136"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Djaidja Moundjid"}], "timeline": [{"time": "2025-12-10T11:22:46.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-19T19:45:56.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-22T16:03:10.566256Z", "id": "CVE-2025-14298", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-22T16:03:20.117Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14298", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-22T16:03:10.566256Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-22T16:03:13.723Z"}}], "cna": {"title": "FiboSearch \u2013 Ajax Search for WooCommerce <= 1.32.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via thegem_te_search Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Djaidja Moundjid"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "damian-gora", "product": "FiboSearch \u2013 Ajax Search for WooCommerce", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.32.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-10T11:22:46.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-19T19:45:56.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8149103e-105d-401d-8a15-b07d131baaac?source=cve"}, {"url": "https://wordpress.org/plugins/ajax-search-for-woocommerce"}, {"url": "https://plugins.trac.wordpress.org/browser/ajax-search-for-woocommerce/tags/1.32.0/partials/themes/thegem-elementor.php#L94"}, {"url": "https://plugins.trac.wordpress.org/browser/ajax-search-for-woocommerce/tags/1.32.0/partials/themes/thegem-elementor.php#L104"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3420841%40ajax-search-for-woocommerce%2Ftrunk&old=3398612%40ajax-search-for-woocommerce%2Ftrunk&sfp_email=&sfph_mail=#file136"}], "descriptions": [{"lang": "en", "value": "The FiboSearch \u2013 Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `thegem_te_search` shortcode in all versions up to, and including, 1.32.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability requires TheGem theme (premium) to be installed with Header Builder mode enabled, and the FiboSearch \"Replace search bars\" option enabled for TheGem integration."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:03:42.489Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14298", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:03:42.489Z", "dateReserved": "2025-12-08T21:19:05.583Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-20T08:22:10.732Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "FiboSearch \u2013 Ajax Search for WooCommerce", "vendor": "damian-gora", "versions": [{"lessThanOrEqual": "1.32.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The FiboSearch \u2013 Ajax Search for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's `thegem_te_search` shortcode in all versions up to, and including, 1.32.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability requires TheGem theme (premium) to be installed with Header Builder mode enabled, and the FiboSearch \"Replace search bars\" option enabled for TheGem integration."}], "id": "CVE-2025-14298", "lastModified": "2026-06-17T08:35:41.353", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14298", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-12-22T16:03:10.566256Z", "version": "2.0.3"}}]}, "published": "2025-12-20T09:15:55.043", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ajax-search-for-woocommerce/tags/1.32.0/partials/themes/thegem-elementor.php#L104"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ajax-search-for-woocommerce/tags/1.32.0/partials/themes/thegem-elementor.php#L94"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3420841%40ajax-search-for-woocommerce%2Ftrunk&old=3398612%40ajax-search-for-woocommerce%2Ftrunk&sfp_email=&sfph_mail=#file136"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/ajax-search-for-woocommerce"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/8149103e-105d-401d-8a15-b07d131baaac?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T16:58:30.655098+00:00", "value": {"mitigation_remediation": ["Upgrade the FiboSearch Ajax Search for WooCommerce plugin to a version released after 1.32.0 that addresses the XSS flaw.", "If an upgrade cannot be performed immediately, disable either TheGem\u2019s Header Builder mode or the FiboSearch \"Replace search bars\" option to eliminate the execution path for the bad shortcode.", "Identify and remove any existing instances of thegem_te_search shortcode containing malicious attributes from the WordPress database; this can be done via the admin interface or directly in the wp_posts and wp_postmeta tables."], "summary": {"action": "Upgrade Plugin", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "Vendors \u2013 Damian\u2011Gora. Product \u2013 FiboSearch \u2013 Ajax Search for WooCommerce, all releases up to and including 1.32.0. The vulnerability requires that the TheGem theme (premium) be installed with Header Builder mode enabled and that the FiboSearch \"Replace search bars\" option is turned on for TheGem integration, creating a true attack surface.", "description_and_impact": "The FiboSearch \u2013 Ajax Search for WooCommerce plugin allows unauthorized script injection because the thegem_te_search shortcode does not properly sanitize or escape user-supplied attributes. This stored cross\u2011site scripting flaw means that an attacker with Contributor-level access or higher can inject arbitrary JavaScript that will run when any user visits affected pages, enabling session hijacking, defacement, or credential theft. The weakness is a classic Cross\u2011Site Scripting error, classified as CWE\u201179.", "risk_and_exploitability": "The CVSS score of 5.4 indicates a medium severity; however, because the EPSS score is less than 1\u202f% it is not commonly exploited yet, and the vulnerability is not listed in CISA\u2019s KEV catalog. The attack vector is a web application scenario where an authenticated Contributor (or higher) user creates or edits content that includes the vulnerable shortcode. Once injected, the script will execute in the browsers of all visitors to the injected page, making exploitation simple for anyone with sufficient privileges."}}}}, "created": "2025-12-21T21:12:25.772204+00:00", "updated": "2026-04-21T17:00:12.333654+00:00", "vendors": ["fibosearch", "fibosearch$PRODUCT$fibosearch", "woocommerce", "woocommerce$PRODUCT$woocommerce", "wordpress", "wordpress$PRODUCT$wordpress"]}