Wpdreams vulnerabilities
Published CVEs affecting Wpdreams products: 4 record(s), with severity, exploitation and fixes.
CVE-2026-110360
Medium · 5.3
CWE-862 Oct 15, 2026
WordPress Ajax Search Lite plugin <= 4.14.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ajax Search Lite: from n/a through 4.14.5.
CVE-2026-96331
Critical · 9.3
CWE-89 Oct 9, 2026
WordPress Ajax Search Pro plugin <= 4.29.1 - SQL Injection vulnerability
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in wpdreams Ajax Search Pro ajax-search-pro allows Blind SQL Injection.This issue affects Ajax Search Pro: from n/a through 4.29.1.
CVE-2025-48086
Medium · 5.5
CWE-502 Nov 6, 2025
WordPress Ajax Search Lite plugin <= 4.13.3 - PHP Object Injection vulnerability
Deserialization of Untrusted Data vulnerability in wpdreams Ajax Search Lite ajax-search-lite allows Object Injection.This issue affects Ajax Search Lite: from n/a through <= 4.13.3.
CVE-2025-11926
Medium · 4.4
CWE-79 Oct 18, 2025
Related Posts Lite <= 1.12 - Authenticated (Admin+) Stored Cross-Site Scripting
The Related Posts Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.