Bukazu Search Widget

Bukazu Search Widget has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for Bukazu Search Widget has a vendor fix available, so running the current release closes it.

All of these findings were reported by Gilang - DJ. Bukazu Search Widget is installed on roughly 10 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.

Strategic Overview

Avg CVSSMedium

6.4/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Bukazu Search Widget vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2025-13840

BUKAZU Search widget <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode' Shortcode Attribute

Read the full analysis

Vulnerability Records

1 records


2025-12-11 14:31	BUKAZU Search widget <= 3.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'shortcode' Shortcode Attribute Bukazu Search Widget <= 3.3.2	`CVE-2025-13840`	6.4 Medium	Gilang - DJ	Yes

Showing 1–1 of 1 reports

Plugin Profile

Latestv4.0

Bukazu Search Widget

Author

bobvanoorschot

0.0(0)

0/100

Last Updated

2026-03-26 (6mo ago)

Active Installs

10+

Downloads

2,502

Requires WP

6.0+

Requires PHP

7.2+

Tested up to

WP 6.9.7

Created

2018-08-16 (8y ago)

This is used with the bukazu bookings system, you need to have an account with BUKAZU The plugin includes a Gutenberg block, bukazu/portal, for embedding the Bukazu portal directly in the block editor without using a shortcode. The preferred integration method is the Gutenberg block. Use the shortcode only when you need to support classic editor or template-based integrations.

View on WordPress.org