CVE-2026-2837

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

The Ricerca – advanced search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via plugin's settings in all versions up to, and including, 1.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Mar 21, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-283709.1In the query parser in OpenStack Vitrage before 12.0.1, 13.0.0, 14.0.0, and 15.0.0, a user allowed to access the Vitrage API may trigger cod CVE-2026-283727.8telnetd in GNU inetutils through 2.7 allows privilege escalation that can be exploited by abusing systemd service credentials support added CVE-2026-283739.6The Stackfield Desktop App before 1.10.2 for macOS and Windows contains a path traversal vulnerability in certain decryption functionality w CVE-2026-283744.3Editors could delete any annotation, even those they do not have read access to. The editor user cannot create or read the annotations.CVE-2026-283756.5A testdata data-source can be used to trigger out-of-memory crashes in Grafana.CVE-2026-283766.5The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potential CVE-2026-283777.5A vulnerability in Grafana Tempo exposes the S3 SSE-C encryption key in plaintext through the /status/config endpoint, potentially allowing CVE-2026-283782.7The public dashboard deletion endpoint does not enforce organization isolation, allowing an Org Admin in one organization to delete public d CVE-2026-283796.5A race condition in Grafana Live allows authenticated users with Viewer role to trigger a server crash by sending concurrent requests that c CVE-2026-28384.4The Whole Enquiry Cart for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘woowhole_success_msg’ para CVE-2026-283806.5Any Editor could delete any snapshot, even if they have no access to read or write them.CVE-2026-283818.1The Snowflake datasource allows for GET/PUT commands, which can allow any user with access to run queries against the data source to read/wr