WordPress WP-Advanced-Search

WordPress WP-Advanced-Search has 7 disclosed vulnerabilities in the WordSec catalog, reported between 2020 and 2025; 6 are fixed and 1 remains unpatched as of September 2026. Their average CVSS score is 7.2, and the most serious one scores 9.8 out of 10. Severity breakdown: 1 critical and 4 high. 2020 was the busiest year with 3 disclosures.

The most common weakness is SQL Injection, behind 2 of the records (29%). Other recurring categories include Code Injection, Cross-Site Request Forgery (CSRF).

6 of the records (86%) have a vendor fix, while 1 remain unpatched. The oldest unresolved one dates back to 2025.

6 independent researchers contributed these findings, most of them (2) reported by Florian Hauser.

Strategic Overview

Avg CVSSHigh

7.2/ 10

Patch Coverage86%

Open

Fixed

Get automatic notifications for all WordPress WP-Advanced-Search vulnerabilities before they are exploited.

Most severe open issueCVSS 7.2CVE-2025-39538

WP-Advanced-Search <= 3.3.9.3 - Authenticated (Admin+) Arbitrary File Upload

Read the full analysis

Vulnerability Records

7 records


2025-04-16 00:00	WP-Advanced-Search <= 3.3.9.3 - Authenticated (Admin+) Arbitrary File Upload WordPress WP-Advanced-Search <= 3.3.9.3	`CVE-2025-39538`	7.2 High	Nabil Irawan	No
2025-03-03 00:00	WordPress WP-Advanced-Search <= 3.3.9.2 - Authenticated (Admin+) Stored Cross-Site Scripting WordPress WP-Advanced-Search <= 3.3.9.2	`CVE-2024-10554`	4.4 Medium	Ilteris Kaan Pehlivan	Yes
2024-09-17 00:00	WordPress WP-Advanced-Search <= 3.3.9 - Unauthenticated SQL Injection WordPress WP-Advanced-Search <= 3.3.9	`CVE-2024-9796`	7.5 High	Wojciech Jezowski	Yes
2023-03-14 00:00	WP-Advanced-Search <= 3.3.8 - Cross-Site Request Forgery leading to Plugin Settings Updates WordPress WP-Advanced-Search <= 3.3.8	`CVE-2022-47447`	4.3 Medium	rezaduty	Yes
2020-04-28 00:00	WordPress WP-Advanced-Search <= 3.3.6 - SQL Injection WordPress WP-Advanced-Search <= 3.3.6	`CVE-2020-12104`	8.8 High	Nawaf Alkeraithe, Hashim Alshareef	Yes
2020-03-05 00:00	WordPress WP-Advanced-Search <= 3.3.3 - Remote Code Execution WordPress WP-Advanced-Search < 3.3.4	`N/A`	9.8 Critical	Florian Hauser	Yes
2020-03-05 00:00	WordPress WP-Advanced-Search <= 3.3.3 - Unauthenticated Database Export WordPress WP-Advanced-Search <= 3.3.3	`N/A`	8.6 High	Florian Hauser	Yes

Showing 1–7 of 7 reports