Vulnerabilities and security researches forsearchiq searchiq

Jun 07, 2024

CVE, Research URL: CVE-2024-31259
Home page URL: Security reports for SearchIQ – The Search Solution
Application: SearchIQ – The Search Solution
Date: Apr 10, 2024
Research Description: Insertion of Sensitive Information into Log File vulnerability in Searchiq SearchIQ.This issue affects SearchIQ: from n/a through 4.5.
Affected versions: Min -, max -.
Status: vulnerable

CVE, Research URL: CVE-2022-0780
Home page URL: Security reports for SearchIQ – The Search Solution
Application: SearchIQ – The Search Solution
Date: Apr 18, 2022
Research Description: The SearchIQ WordPress plugin before 3.9 contains a flag to disable the verification of CSRF nonces, granting unauthenticated attackers access to the siq_ajax AJAX action and allowing them to perform Cross-Site Scripting attacks due to the lack of sanitisation and escaping in the customCss parameter
Affected versions: Min -, max -.
Status: vulnerable

Jun 10, 2024

CVE, Research URL: CVE-2023-47832
Home page URL: Security reports for SearchIQ – The Search Solution
Application: SearchIQ – The Search Solution
Date: Dec 09, 2024
Research Description: Missing Authorization vulnerability in searchiq SearchIQ allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SearchIQ: from n/a through 4.4.
Affected versions: Min -, max -.
Status: vulnerable

Dec 06, 2024

CVE, Research URL: CVE-2024-10885
Home page URL: Security reports for SearchIQ – The Search Solution
Application: SearchIQ – The Search Solution
Date: Dec 04, 2024
Research Description: The SearchIQ – The Search Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siq_searchbox' shortcode in all versions up to, and including, 4.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: Min -, max -.
Status: vulnerable

Jan 01, 2025

CVE, Research URL: CVE-2024-56229
Home page URL: Security reports for SearchIQ – The Search Solution
Application: SearchIQ – The Search Solution
Date: Dec 31, 2024
Research Description: Cross-Site Request Forgery (CSRF) vulnerability in Searchiq SearchIQ.This issue affects SearchIQ: from n/a through 4.6.
Affected versions: Min -, max -.
Status: vulnerable

Mar 06, 2025

CVE, Research URL: CVE-2024-13350
Home page URL: Security reports for SearchIQ – The Search Solution
Application: SearchIQ – The Search Solution
Date: Mar 05, 2025
Research Description: The SearchIQ – The Search Solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'siq_searchbox' shortcode in all versions up to, and including, 4.7 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected versions: Min -, max -.
Status: vulnerable

Apr 03, 2025

CVE, Research URL: CVE-2025-30867
Home page URL: Security reports for SearchIQ – The Search Solution
Application: SearchIQ – The Search Solution
Date: Mar 27, 2025
Research Description: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SearchIQ SearchIQ allows Stored XSS. This issue affects SearchIQ: from n/a through 4.7.
Affected versions: Min -, max -.
Status: vulnerable