The FiboSearch – Ajax Search for WooCommerce plugin allows unauthorized script injection because the thegem_te_search shortcode does not properly sanitize or escape user-supplied attributes. This stored cross‑site scripting flaw means that an attacker with Contributor-level access or higher can inject arbitrary JavaScript that will run when any user visits affected pages, enabling session hijacking, defacement, or credential theft. The weakness is a classic Cross‑Site Scripting error, classified as CWE‑79.

Vendors – Damian‑Gora. Product – FiboSearch – Ajax Search for WooCommerce, all releases up to and including 1.32.0. The vulnerability requires that the TheGem theme (premium) be installed with Header Builder mode enabled and that the FiboSearch "Replace search bars" option is turned on for TheGem integration, creating a true attack surface.

The CVSS score of 5.4 indicates a medium severity; however, because the EPSS score is less than 1 % it is not commonly exploited yet, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is a web application scenario where an authenticated Contributor (or higher) user creates or edits content that includes the vulnerable shortcode. Once injected, the script will execute in the browsers of all visitors to the injected page, making exploitation simple for anyone with sufficient privileges.