XiSearch Bar WordPress Plugin Cross-Site Request Forgery Vulnerability

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in the XiSearch bar plugin for WordPress, affecting all versions through 2.6. The vulnerability arises from inadequate nonce validation on the 'xisearch-key-config' page, allowing unauthenticated attackers to manipulate settings and inject malicious scripts. Exploitation requires tricking a site administrator into performing an action, such as clicking a link.

Impact

Exploitation of this vulnerability could lead to Cross-Site Scripting (XSS) attacks, as the injected scripts would be executed in the context of the user.