NotFound Curated Search Cross-Site Request Forgery Vulnerability Allowing Stored Cross-Site Scripting

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the NotFound Curated Search WordPress plugin, specifically in versions through 1.2. This vulnerability allows for Stored Cross-Site Scripting (XSS) attacks.

Impact

Exploitation of this vulnerability allows for Stored Cross-Site Scripting, where injected scripts are executed when users visit the affected site.

Remediation

Users of the NotFound Curated Search WordPress plugin are advised to update to version 1.2 or later. For those unable to update immediately, Patchstack has issued a virtual patch that blocks attacks targeting this vulnerability.