Unauthenticated Cross Site Scripting (XSS) exists in the YITH WooCommerce Ajax Search plugin through version 2.28.0. An attacker can inject arbitrary script code into the web page that is served to visitors, allowing the execution of malicious actions in the context of the user’s browser. The flaw originates from insufficient output sanitisation of user‑supplied data, classifying it under CWE‑79.

YITH WooCommerce Ajax Search plugin, developed by YITHEMES, affecting all installed releases up to and including 2.28.0. The affected product is commonly used by WordPress sites that list WooCommerce products and provide Ajax search functionality.

The vulnerability is scored as a high severity CVSS 7.1 and has no exploit bounty data available; it is also not listed in the CISA Known Exploited Vulnerabilities catalog. Because unauthenticated users can trigger the flaw by simply visiting pages that use the plugin or submitting search queries, the attack vector is likely a generic web‑application exploit that requires no special privileges. Given the lack of mitigation from WordPress or other platform controls, the risk to sites that use the vulnerable plugin remains significant, especially those exposed to public traffic.