The SearchWiz plugin for WordPress contains a Stored Cross‑Site Scripting flaw that allows authenticated users with contributor privileges to inject malicious scripts into post titles displayed in search results. The plugin incorrectly uses esc_attr() instead of esc_html() when rendering these titles, meaning that any JavaScript embedded in a title will be executed in the browser of every user who performs a search. Although the bug is limited to authenticated users, the injected code can steal session cookies, deface content, or redirect victims to malicious sites.

WordPress sites running the SearchWiz plugin version 1.0.0 or earlier are affected. The vulnerability does not apply to newer releases (if any).

The CVSS score of 6.4 indicates moderate severity. Exploit probability is very low with an EPSS of less than 1%, and the vulnerability is not listed in the CISA KEV catalog. The attack requires contributor‑level or higher privileges and affects only those users who can add or edit posts to introduce the injection. Successful exploitation lets the attacker run arbitrary scripts in the victim’s browser context, enabling hijacking of sessions, defacement, or redirection.