Wp Dreams develops a focused WordPress plugin portfolio centered on the Ajax Search product, which extends search functionality in WordPress installations. The vendor's vulnerability disclosures, though modest in scope, reflect the input-handling complexity common to search and filtering plugins. Live severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Wp Dreams over time
Signals from CVEs in this vendor scope (7 CVEs).
7 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2023-1420MEDIUM The Ajax Search Lite WordPress plugin before 4.11.1, Ajax Search Pro WordPress plugin before 4.26.2 does not sanitise and escape a parameter before outputting it back in a response | Apr 24, 2023 | 6.1 | 21 | NO | NO |
CVE-2024-21752MEDIUM Cross-Site Request Forgery (CSRF) vulnerability in Ernest Marcinko Ajax Search Lite allows Reflected XSS.This issue affects Ajax Search Lite: from n/a through 4.11.4. | Feb 29, 2024 | 6.1 | 18 | NO | NO |
CVE-2024-7084MEDIUM The Ajax Search Lite WordPress plugin before 4.12.1 does not sanitise and escape some parameters, which could allow users with a role as low as Admin+ to perform Cross-Site Scripti | Aug 6, 2024 | 4.8 | 17 | NO | NO |
CVE-2023-1435MEDIUM The Ajax Search Pro WordPress plugin before 4.26.2 does not sanitise and escape various parameters before outputting them back in pages, leading to a Reflected Cross-Site Scripting | Apr 24, 2023 | 6.1 | 17 | NO | NO |
CVE-2024-8619MEDIUM The Ajax Search Lite WordPress plugin before 4.12.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross | May 15, 2025 | 4.8 | 16 | NO | NO |
CVE-2024-10568MEDIUM The Ajax Search Lite WordPress plugin before 4.12.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross | Dec 12, 2024 | 4.7 | 16 | NO | NO |
The Ajax Search Lite WordPress plugin before 4.12.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross | Feb 21, 2025 | 3.5 | 14 | NO | NO |
Signals from CVEs in this vendor scope (7 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Wp Dreams.
Media articles that mention a CVE ID that affects a product developed by Wp Dreams — matched by CVE ID, not by vendor name.