Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-08-26
Ajax Search Lite - Remote Code Execution (CVE-2026-16258)
The Ajax Search Lite WordPress plugin before 4.14.5 does not prevent the deserialization of untrusted input, allowing unauthenticated attackers to perform PHP Object Injection. When a suitable POP chain is present via another installed Ajax Search Lite WordPress plugin before 4.14.5 or , this can be leveraged to achieve Remote Code Execution.
PLUGIN
Ajax Search Lite
CVE-2026-16258
Risk Score
Threat Entry
Updated 2026-08-12
Ajax Search Lite - PHP Object Injection (CVE-2026-28139)
Unauthenticated PHP Object Injection in Ajax Search Lite
PLUGIN
Ajax Search Lite
CVE-2026-28139
Risk Score
Threat Entry
Updated 2026-06-17
Ajax Search Lite - PHP Object Injection (CVE-2025-48086)
Deserialization of Untrusted Data vulnerability in wpdreams Ajax Search Lite ajax-search-lite allows Object Injection.This issue affects Ajax Search Lite: from n/a through
PLUGIN
Ajax Search Lite
CVE-2025-48086
Risk Score
Threat Entry
Updated 2026-06-17
Ajax Search Lite - Broken Access Control (CVE-2025-7956)
The Ajax Search Lite plugin for WordPress is vulnerable to Basic Information Exposure due to missing authorization in its AJAX search handler in all versions up to, and including, 4.13.1. This makes it possible for unauthenticated attackers to issue repeated AJAX requests to leak the content of any protected post in rolling 100‑character windows.
PLUGIN
Ajax Search Lite
CVE-2025-7956
Risk Score
Threat Entry
Updated 2026-06-17
Ajax Search Lite - Cross-Site Scripting (XSS) (CVE-2024-8619)
The Ajax Search Lite WordPress plugin before 4.12.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Ajax Search Lite
CVE-2024-8619
Risk Score
Threat Entry
Updated 2026-06-17
Ajax Search Lite - Cross-Site Scripting (XSS) (CVE-2024-13585)
The Ajax Search Lite WordPress plugin before 4.12.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Ajax Search Lite
CVE-2024-13585
Risk Score
Threat Entry
Updated 2026-06-17
Ajax Search Lite - Cross-Site Scripting (XSS) (CVE-2024-10568)
The Ajax Search Lite WordPress plugin before 4.12.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).
PLUGIN
Ajax Search Lite
CVE-2024-10568
Risk Score
Threat Entry
Updated 2026-06-17
Ajax Search Lite - Cross-Site Scripting (XSS) (CVE-2024-7084)
The Ajax Search Lite WordPress plugin before 4.12.1 does not sanitise and escape some parameters, which could allow users with a role as low as Admin+ to perform Cross-Site Scripting attacks.
PLUGIN
Ajax Search Lite
CVE-2024-7084
Risk Score
Threat Entry
Updated 2026-06-17
Ajax Search Lite - Cross-Site Scripting (XSS) (CVE-2023-1420)
The Ajax Search Lite WordPress plugin before 4.11.1, Ajax Search Pro WordPress plugin before 4.26.2 does not sanitise and escape a parameter before outputting it back in a response of an AJAX action, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
PLUGIN
Ajax Search Lite
CVE-2023-1420
Risk Score