Input validation vulnerability in Lava Ajax Search 1.1.9

The Lava Ajax Search plugin for WordPress has a security issue in versions 1.1.9 and below. This vulnerability, called Stored Cross-Site Scripting, is caused by not properly checking and formatting user input. As a result, attackers with administrator-level access or higher can insert harmful code onto pages that will run when a user views the page. This only affects websites with multiple sites, or sites that have disabled the unfiltered_html feature.