The Bukazu Search Widget plugin for WordPress is vulnerable to stored cross‑site scripting due to insufficient sanitization of the 'shortcode' attribute in the 'bukazu_search' shortcode. An authenticated user with Contributor role or higher can persist arbitrary JavaScript in the widget configuration, which will then execute in the browsers of any visitor who loads a page containing the widget. This flaw enables an attacker to run client‑side code on all site visitors that view the affected page.

All installations of the Bukazu Search Widget plugin by Bob Van Aorschot, up to and including version 3.3.2, are affected. Any WordPress site running this plugin version with the widget enabled and with users that have Contributor or higher roles may be impacted.

The CVSS score of 6.4 indicates moderate severity, while the EPSS score of less than 1 % shows a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. An attacker must first be authenticated as a Contributor or higher, then create a malicious widget configuration using the unsanitized 'shortcode' attribute. Once persisted, any visitor to the page containing that widget will have the attacker‑supplied script executed in their browser, providing a significant client‑side attack surface.