CVE-2024-8619: 
WordPress vulnerability analysis and mitigation

The Ajax Search Lite WordPress plugin before version 4.12.3 contains a stored cross-site scripting (XSS) vulnerability. The vulnerability was discovered and disclosed on May 15, 2025, affecting WordPress installations using the Ajax Search Lite plugin versions 4.12.2 and below (WPScan).

The vulnerability stems from insufficient sanitization and escaping of certain plugin settings. This security flaw has been assigned a CVSS score of 4.8 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. The issue specifically affects high-privilege users such as administrators, allowing them to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed, such as in multisite setups (NVD, WPScan).

When successfully exploited, this vulnerability enables authenticated administrators to store and execute malicious JavaScript code on the website, even in environments where such capabilities are typically restricted, such as in WordPress multisite configurations (Wiz).

The vulnerability has been patched in Ajax Search Lite version 4.12.3. Users are strongly advised to update to this version or later to mitigate the security risk (WPScan).