The FiboSearch – Ajax Search for WooCommerce plugin is vulnerable to stored cross‑site scripting because the "purchased_plan" parameter is not sanitized or escaped before storage. An authenticated user with subscriber‑level or higher access can inject arbitrary JavaScript that will execute whenever another user views a page containing the injected payload. The flaw allows attackers to run arbitrary scripts when other users access the compromised page, potentially disrupting the affected users or revealing sensitive information.

The vulnerability affects the FiboSearch – Ajax Search for WooCommerce WordPress plugin developed by damian-gora. All releases up to and including version 1.34.2 are impacted; versions 1.34.3 and newer contain the fix.

The CMS‑provided CVSS score of 6.4 indicates moderate severity for the stored cross‑site scripting flaw. Exploitation requires that the site owner has completed the Freemius opt‑in flow; after that any subscriber can trigger the vulnerable handler by accessing /wp-admin/profile.php with the appropriate query parameters. Although the EPSS score is not available and the flaw is not listed in CISA KEV, the attack vector is realistic for sites that keep the vulnerable plugin and provide subscriber access.