WP Extended Search
WP Extended Search has one disclosed vulnerability in the WordSec catalog, all reported in 2023; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for WP Extended Search has a vendor fix available, so running the current release closes it.
All of these findings were reported by István Márton. WP Extended Search is installed on roughly 20,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 6.9.7.
CVE-2022-4649WP Extended Search <= 2.1.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Read the full analysisVulnerability Records

WP Extended Search
Author
Sumit Singh
WP Extended Search is a lightweight and powerful search plugin. With this plugin you can customize WordPress search to search in Post Meta, Author names, Categories, Tags, or Custom Taxonomies via admin settings. You can control the default behavior of WordPress to search in the post title, post content, and post excerpt. Apart from customizing default search behavior, you can create multiple search settings, and then you can assign these settings to custom search forms. For custom search forms, you have the option to choose from a widget, shortcode, PHP function, or HTML. Features Search in selected meta keys Search in category, tags or custom taxonomies Search in the post author name Include or exclude any public post type Control whether to search in title or content or excerpt or all Compatible with WooCommerce. Search in product SKU, Attributes, variations, and custom fields, etc. Create unlimited search settings to use with custom search forms. Add search forms using a widget, shortcode or PHP function. Also works with custom searchform.php Exclude old content from search results (Older than admin specified date) Customize the number of posts to display on the search results page Customize SQL relation (AND/OR) between search terms Customize order of search results Control whether to match search query exactly or partially Limit attachment results by mime type e.g. display only pdf files in search results. Translation ready Compatible with WPML Links Documentation GitHub
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C