The Ricerca – advanced search plugin for WordPress contains a stored cross‑site scripting flaw in its configuration page. An authenticated user with administrator-level privileges can insert JavaScript that is later rendered in pages viewed by other users. This enables attackers to deface a site, steal credentials, hijack sessions, or load malicious content. The flaw is rated moderate (CVSS 4.4) and is not listed in the CISA Known Exploited Vulnerabilities catalog.

Any WordPress installation running Ricerca – advanced search version 1.1.12 or earlier, including multi‑site setups and those that have disabled the unfiltered_html capability, is vulnerable. The affected product is provided by systemsrtk as the Ricerca – advanced search plugin.

Exploitation requires administrator authentication, meaning the attacker must already possess administrative rights. Once the script is stored via the settings page, it will execute automatically for all users who view affected pages. The moderate CVSS score indicates that while the vulnerability is non‑critical, it can still have significant impact in environments where administrative privileges are widely distributed. No EPSS score is available, so it is unclear how frequently this vulnerability is actively exploited. The absence from the KEV list suggests it has not been widely weaponised yet.