CVE-2022-2535: Searchwp Live AJAX Search

Medium severity, CVSS 5.3. EPSS: 2% chance of exploitation in the next 30 days.

The SearchWP Live Ajax Search WordPress plugin before 1.6.2 does not ensure that users making a live search are limited to published posts only, allowing unauthenticated users to make a crafted query disclosing private/draft/pending post titles along with their permalink

Affected products

• Searchwp Searchwp Live AJAX Search: before 1.6.2 (fixed in 1.6.2)

Published 2022-08-15. Last modified 2026-06-17.