{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2837", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-19T21:38:17.600Z", "datePublished": "2026-03-21T03:27:10.508Z", "dateUpdated": "2026-04-08T17:28:11.722Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:28:11.722Z"}, "affected": [{"vendor": "systemsrtk", "product": "Ricerca \u2013 advanced search", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.12", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Ricerca \u2013 advanced search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's settings in all versions up to, and including, 1.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "title": "Ricerca \u2013 advanced search <= 1.1.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Settings", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ddee4794-5b57-4af1-a427-3247882952e9?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ricerca-smart-search/tags/1.1.12/inc/admin_fields.php#L689"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Nur Ibnu Hubab"}], "timeline": [{"time": "2026-01-21T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2026-03-20T15:14:50.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-23T16:56:33.963322Z", "id": "CVE-2026-2837", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T16:56:43.196Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2837", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T16:56:33.963322Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T16:56:38.955Z"}}], "cna": {"title": "Ricerca \u2013 advanced search <= 1.1.12 - Authenticated (Administrator+) Stored Cross-Site Scripting via Plugin's Settings", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Nur Ibnu Hubab"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "systemsrtk", "product": "Ricerca \u2013 advanced search", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.12"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-21T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2026-03-20T15:14:50.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ddee4794-5b57-4af1-a427-3247882952e9?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ricerca-smart-search/tags/1.1.12/inc/admin_fields.php#L689"}], "descriptions": [{"lang": "en", "value": "The Ricerca \u2013 advanced search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's settings in all versions up to, and including, 1.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:28:11.722Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2837", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:28:11.722Z", "dateReserved": "2026-02-19T21:38:17.600Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-21T03:27:10.508Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Ricerca \u2013 advanced search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's settings in all versions up to, and including, 1.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}, {"lang": "es", "value": "El plugin de b\u00fasqueda avanzada Ricerca para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de la configuraci\u00f3n del plugin en todas las versiones hasta la 1.1.12, inclusive, debido a una sanitizaci\u00f3n de entrada insuficiente y un escape de salida inadecuado. Esto permite que atacantes autenticados, con permisos de nivel de administrador y superiores, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada. Esto solo afecta a instalaciones multisitio y a las instalaciones donde se ha deshabilitado 'unfiltered_html'."}], "id": "CVE-2026-2837", "lastModified": "2026-04-24T16:27:44.277", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2026-03-21T04:17:12.993", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ricerca-smart-search/tags/1.1.12/inc/admin_fields.php#L689"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/ddee4794-5b57-4af1-a427-3247882952e9?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.1.12]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Ricerca \u2013 advanced search", "source": "cna", "vendor": "systemsrtk"}, "product": "ricerca_\u2013_advanced_search", "vendor": "systemsrtk"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-21T06:36:47.417724+00:00", "value": {"mitigation_remediation": ["Upgrade Ricerca \u2013 advanced search to the latest release where this issue is fixed. ", "If an upgrade cannot be applied immediately, disable or remove the plugin from all sites until a patch is available. ", "Verify that the unfiltered_html capability is granted only to trusted administrators; consider disabling it entirely to reduce injection risk. ", "Audit all scripts added via the plugin\u2019s settings and remove any malicious or suspicious code. "], "summary": {"action": "Apply Patch", "impact": "Stored Cross\u2011Site Scripting via plugin settings that allows administrators to inject arbitrary scripts"}, "threat_synthesis": {"affected_systems": "Any WordPress installation running Ricerca \u2013 advanced search version 1.1.12 or earlier, including multi\u2011site setups and those that have disabled the unfiltered_html capability, is vulnerable. The affected product is provided by systemsrtk as the Ricerca \u2013 advanced search plugin.", "description_and_impact": "The Ricerca \u2013 advanced search plugin for WordPress contains a stored cross\u2011site scripting flaw in its configuration page. An authenticated user with administrator-level privileges can insert JavaScript that is later rendered in pages viewed by other users. This enables attackers to deface a site, steal credentials, hijack sessions, or load malicious content. The flaw is rated moderate (CVSS 4.4) and is not listed in the CISA Known Exploited Vulnerabilities catalog.", "risk_and_exploitability": "Exploitation requires administrator authentication, meaning the attacker must already possess administrative rights. Once the script is stored via the settings page, it will execute automatically for all users who view affected pages. The moderate CVSS score indicates that while the vulnerability is non\u2011critical, it can still have significant impact in environments where administrative privileges are widely distributed. No EPSS score is available, so it is unclear how frequently this vulnerability is actively exploited. The absence from the KEV list suggests it has not been widely weaponised yet."}}}}, "created": "2026-03-23T09:49:48.882525+00:00", "updated": "2026-03-25T14:41:28.361923+00:00", "vendors": ["systemsrtk", "systemsrtk$PRODUCT$ricerca_\u2013_advanced_search", "wordpress", "wordpress$PRODUCT$wordpress"]}