¿Es seguro Ajax Search Lite?

Qué hace este plugin

• Slug: ajax-search-lite
• 80000+ instalaciones activas

better searchlive searchproduct searchsearchwoocommerce search

Estado de mantenimiento

• Última versión conocida: 4.14.4
• Requiere PHP: 7.4+
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

8 CVEs conocidos registrados para Ajax Search Lite.

CVE-2025-48086

The Ajax Search Lite plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 4.13.3 via deserialization of untrusted input. This makes it possible for authenticated attackers, with administrator-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-13585

The Ajax Search Lite – Live Search & Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.12.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-10568

The Ajax Search Lite – Live Search & Filter plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.12.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-7084

The Ajax Search Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-21752

Update the WordPress Ajax Search Lite plugin to the latest available version (at least 4.11.5). Le Ngoc Anh discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Ajax Search Lite Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 4.11.5. Have additional information or questions about this entry? Get in touch.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2023-1420

Update the WordPress Ajax Search Lite plugin to the latest available version (at least 4.11.1). Erwan LR discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Ajax Search Lite Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 4.11.1.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

CVE-2022-38456

The Ajax Search Lite plugin for WordPress is vulnerable to Missing Authorization (leading to Sensitive Information Disclosure) in versions up to, and including, 4.10.3 via the 'searchCF' function. This can allow subscriber-level attackers to extract sensitive data including post metadata from an unprotected Ajax endpoint.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Ajax Search Lite – Live Search & Filter [ajax-search-lite] < 3.11

The Ajax Search Lite plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the wpdreams_ajaxinputcallback function in versions up to, and including, 3.10. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to bypass restricted actions, which can lead to remote code execution.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

+ 6 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
—	Ajax Search Lite – Live Search & Filter [ajax-search-lite] < 3.11	—	Desconocido	< 3.11	3.11	2015-03-18	✓ corregido en la última versión
—	Ajax Search Lite – Live Search & Filter [ajax-search-lite] < 3.0	—	Desconocido	< 3.0	3.0	2015-03-18	✓ corregido en la última versión
—	Ajax Search Lite – Live Search & Filter [ajax-search-lite] < 3.11	—	Desconocido	< 3.11	3.11	2014-06-24	✓ corregido en la última versión
CVE-2024-8619	Ajax Search Lite – Live Search & Filter [ajax-search-lite] < 4.12.3	Neutralización incorrecta de la entrada al generar la página web (Cross-site Scripting / XSS)	Media 4,8	< 4.12.3	4.12.3	0000-00-00	✓ corregido en la última versión
—	Ajax Search Lite – Live Search & Filter [ajax-search-lite] < 4.13.2	—	Media 5,3	< 4.13.2	4.13.2	0000-00-00	✓ corregido en la última versión
—	Ajax Search Lite – Live Search & Filter [ajax-search-lite] < 3.11	—	Desconocido	< 3.11	3.11	—	✓ corregido en la última versión

Ajax Search Lite – Live Search & Filter [ajax-search-lite] < 3.11

This vulnerability allows any registered user to execute any function he wants. Upgrade the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Ajax Search Lite – Live Search & Filter [ajax-search-lite] < 3.0

Because of this vulnerability, any registered user to execute any function he wants with 1st param set to array($_POST). Update the plugin.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Ajax Search Lite – Live Search & Filter [ajax-search-lite] < 3.11

The Ajax Search Lite plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 3.10 via the TimThumb’s "Webshot" feature. This allows unauthenticated attackers to execute code on the server.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2024-8619

The Ajax Search Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 4.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

Ajax Search Lite – Live Search & Filter [ajax-search-lite] < 4.13.2

The Ajax Search Lite plugin for WordPress is vulnerable to Basic Information Exposure due to missing authorization in its AJAX search handler in all versions up to, and including, 4.13.1. This makes it possible for unauthenticated attackers to issue repeated AJAX requests to leak the content of any protected post in rolling 100‑character windows.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Ajax Search Lite – Live Search & Filter [ajax-search-lite] < 3.11

Proof of Concept: This will register an administrator with username "xADMIN" and password "xPASS": POST request to: /wp-admin/admin-ajax.php?page=ajax-search-pro/backend/settings.php&action=wpdreams-ajaxinput With POST data: wpdreams_callback=wp_insert_user&user_login=xADMIN&user_pass=xPASS&role=administrator

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: WPScan

Cómo solucionarlo

Mantén Ajax Search Lite actualizado — 4.14.4 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• Relevanssi – A Better Search — 100000+ instalaciones activas — 96/100 (404) — PHP máx. 8.4
• Advanced Woo Search – Product Search for WooCommerce — 70000+ instalaciones activas — 96/100 (246) — PHP máx. 8.4
• ACF: Better Search — 40000+ instalaciones activas — 98/100 (165) — PHP máx. 8.4
• Advance Product Search- Voice & Ajax Search for WooCommerce — 10000+ instalaciones activas — 100/100 (5) — PHP máx. 8.4
• Better Search – Relevant search results for WordPress — 5000+ instalaciones activas — 88/100 (61)