CVE-2025-47507: 
WordPress vulnerability analysis and mitigation

A DOM-Based Cross-site Scripting (XSS) vulnerability has been identified in Ajay Better Search plugin affecting versions through 4.1.0. The vulnerability was discovered on May 7, 2025, and was assigned CVE-2025-47507 with a CVSS v3.1 base score of 6.5 (Medium) (Wiz, NVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and specifically manifests as a DOM-Based XSS issue. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L, indicating network accessibility, low attack complexity, and required user interaction (NVD, Patchstack).

This vulnerability could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into the website which will be executed when guests visit the site. The impact affects confidentiality, integrity, and availability at a low level for each aspect (Patchstack).

The vulnerability requires low attack complexity and user interaction for successful exploitation. It has been assigned a medium severity rating, suggesting moderate exploitation potential (Wiz).

The recommended solution is to update to version 4.1.1 or later of the Better Search plugin. This security issue has been patched in the updated version and is considered to have a low severity impact (Patchstack).