An unauthenticated Cross‑Site Scripting vulnerability exists in the WordPress Advance Product Search plugin by ThemeHunk when version is 1.4.8 or earlier. The flaw permits an attacker to inject arbitrary JavaScript into the output rendered by the plugin, which will run in the browsers of any user who views a page containing the plugin’s output. This can enable manipulation of data sent by the victim, potential defacement of the page, or other malicious client‑side actions.

WordPress sites that have the ThemeHunk Advance Product Search plugin installed with a version upgrade‑to‑1.4.8 or earlier are affected.

With a CVSS base score of 7.1 the vulnerability is classified as high. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Because the flaw is unauthenticated, any user who accesses a vulnerable page can trigger the injection, making exploitation likely if an attacker is able to entice visitors through malicious links or compromised content. The vector is an unauthenticated HTTP request that causes the plugin to output unsanitized user‑controlled data.