PLUGIN SECURITY
Is Ajax Search Lite safe?
The Best Ajax Live Search and Filter for WordPress. Live suggestions, Custom Post types, Custom fields, Categories, WooCommerce & Elementor support
What this plugin does
- Slug:
ajax-search-lite - Author: wpdreams
- 70000+ active installs
- 96/100 rating (264 reviews on wordpress.org)
- 2354065 all-time downloads
- On WordPress.org since 2012-11-17
better searchlive searchproduct searchsearchwoocommerce search
Maintenance status
- Latest known version: 4.14.5
- Last updated: 2026-08-21 4:21pm GMT
- Tested up to WordPress: 7.1
- Requires PHP: 7.4+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
12 known CVEs on file for Ajax Search Lite.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-16258 | Ajax Search Lite – Live Search & Filter [ajax-search-lite] < 4.14.5 | Deserialization of Untrusted Data | Unknown | < 4.14.5 | 4.14.5 | 2026-08-03 | ✓ fixed in latest |
| CVE-2025-48086 | Ajax Search Lite – Live Search & Filter [ajax-search-lite] < 4.13.4 | Deserialization of Untrusted Data | Medium 5.5 | < 4.13.4 | 4.13.4 | 2025-10-21 | ✓ fixed in latest |
| CVE-2026-28139 | Ajax Search Lite – Live Search & Filter [ajax-search-lite] < 4.14.5 | Deserialization of Untrusted Data | Critical 9.8 | < 4.14.5 | 4.14.5 | 2025-10-21 | ✓ fixed in latest |
| CVE-2024-13585 | Ajax Search Lite – Live Search & Filter [ajax-search-lite] < 4.12.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Low 3.5 | < 4.12.5 | 4.12.5 | 2025-01-31 | ✓ fixed in latest |
| CVE-2024-10568 | Ajax Search Lite – Live Search & Filter [ajax-search-lite] < 4.12.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.7 | < 4.12.4 | 4.12.4 | 2024-11-21 | ✓ fixed in latest |
| CVE-2024-7084 | Ajax Search Lite – Live Search & Filter [ajax-search-lite] < 4.12.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 4.12.1 | 4.12.1 | 2024-07-16 | ✓ fixed in latest |
| CVE-2024-21752 | Ajax Search Lite – Live Search & Filter [ajax-search-lite] < 4.11.5 | Cross-Site Request Forgery (CSRF) | High 7.1 | < 4.11.5 | 4.11.5 | 2024-01-04 | ✓ fixed in latest |
| CVE-2023-1420 | Ajax Search Lite – Live Search & Filter [ajax-search-lite] < 4.11.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 4.11.1 | 4.11.1 | 2023-04-03 | ✓ fixed in latest |
+ 11 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2022-38456 | Ajax Search Lite – Live Search & Filter [ajax-search-lite] < 4.11.1 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 4.3 | < 4.11.1 | 4.11.1 | 2023-02-06 | ✓ fixed in latest |
| — | Ajax Search Lite – Live Search & Filter [ajax-search-lite] < 3.11 | — | Unknown | < 3.11 | 3.11 | 2015-03-26 | ✓ fixed in latest |
| — | Ajax Search Lite – Live Search & Filter [ajax-search-lite] < 3.11 | — | Unknown | < 3.11 | 3.11 | 2015-03-18 | ✓ fixed in latest |
| — | Ajax Search Lite – Live Search & Filter [ajax-search-lite] < 3.0 | — | Unknown | < 3.0 | 3.0 | 2015-03-18 | ✓ fixed in latest |
| CVE-2014-4663 | Ajax Search Lite – Live Search & Filter [ajax-search-lite] < 3.11 | Improper Control of Generation of Code ('Code Injection') | Unknown | < 3.11 | 3.11 | 2014-06-24 | ✓ fixed in latest |
| — | Ajax Search Lite – Live Search & Filter [ajax-search-lite] < 4.12.3 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 4.12.3 | 4.12.3 | 0000-00-00 | ✓ fixed in latest |
| — | Ajax Search Lite – Live Search & Filter [ajax-search-lite] < 4.13.2 | — | Medium 5.3 | < 4.13.2 | 4.13.2 | 0000-00-00 | ✓ fixed in latest |
| — | Ajax Search Lite – Live Search & Filter [ajax-search-lite] < 3.11 | — | Unknown | < 3.11 | 3.11 | — | ✓ fixed in latest |
| — | Ajax Search Lite < 3.11 - Authenticated RCE | — | Unknown | < 3.11 | 3.11 | — | ✓ fixed in latest |
| CVE-2024-8619 | Ajax Search Lite <= 4.12.2 - Admin+ Stored XSS | — | Unknown | < 4.12.3 | 4.12.3 | — | ✓ fixed in latest |
| CVE-2025-7956 | Ajax Search Lite < 4.13.2 - Missing Authorization to Unauthenticated Basic Information Exposure via ASL_Query in AJAX Search Handler | — | Unknown | < 4.13.2 | 4.13.2 | — | ✓ fixed in latest |
How to fix it
Keep Ajax Search Lite updated — 4.14.5 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- Relevanssi – A Better Search — 100000+ active installs — 96/100 (405) — max PHP 8.4
- Advanced Woo Search – Product Search for WooCommerce — 70000+ active installs — 96/100 (248) — max PHP 8.4
- ACF: Better Search — 40000+ active installs — 98/100 (165) — max PHP 8.4
- Advance Product Search- Voice & Ajax Search for WooCommerce — 9000+ active installs — 100/100 (5) — max PHP 8.4
- Better Search – Relevant search results for WordPress — 5000+ active installs — 88/100 (61)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.