The Advanced Search by My Solr Server plugin for WordPress suffers from a missing or incorrectly validated nonce on its settings page, allowing a forged request to update plugin settings. An attacker who can trick an administrator into clicking a malicious link can inject arbitrary scripts that are then stored by the plugin and executed for every visitor. This constitutes a stored XSS flaw, classified as CWE‑352. The compromise allows an attacker to alter site behavior, steal user credentials, or deliver further malware to site visitors.

All WordPress installations that use the Advanced Search by My Solr Server plugin, specifically versions up to and including 2.0.5, are affected. The plugin is maintained by dbejean; any site employing this component during the stated versions is vulnerable.

The CVSS score of 6.1 indicates a moderate severity. The EPSS score of less than 1% suggests a low probability of exploitation in the wild, and the vulnerability is not listed in CISA’s KEV catalog. Attackers must first coerce a site administrator into executing a forged request, implying that successful exploitation requires user interaction. Because the vulnerability hinges on administrator action, the overall risk to the broader public is limited, but sites with exposed admin interfaces face tangible threat.