The vulnerability is a stored cross‑site scripting flaw caused by improper input neutralization in the Lava Ajax Search plugin. A malicious user could inject script code that the plugin subsequently stores and renders when search results are displayed to visitors, allowing the injected code to execute in the browsers of any user who views those results. Because the code is persisted, the impact can persist across sessions, enabling data exfiltration, session hijacking, or site defacement.

The affected product is the Lava Ajax Search plugin from lavacode, impacting all versions up through 1.1.9. Sites running version 1.1.9 or older should verify whether this plugin is installed and consider updating if available.

With a CVSS score of 5.9 the vulnerability is considered moderate, and its EPSS score of less than 1% indicates a very low exploitation probability. It is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is that an attacker submits malicious search terms that the plugin stores and later renders, leading to script execution in the browsers of visitors reviewing those search results. Effective mitigation hinges on correcting input handling or restricting the feature until a patch is available.