Ivory Search <= 5.4.6 - Reflected Cross-Site Scripting

Wordfence Intelligence   >   Vulnerability Database   >   Ivory Search <= 5.4.6 - Reflected Cross-Site Scripting
6.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVSS 6.1 (Medium)
Publicly Published July 4, 2022
Last Updated January 22, 2024

Description

The Ivory Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via an unknown parameter in versions up to, and including, 5.4.6 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Learn more about Cross-Site Scripting vulnerabilities and how to prevent them.

References

Share

Vulnerability Details for Ivory Search – WordPress Search Plugin

Ivory Search – WordPress Search Plugin

Software Type Plugin
Software Slug add-search-to-menu (view on wordpress.org)
Patched? Yes
Remediation Update to version 5.4.7, or a newer patched version
Affected Version
  • <= 5.4.6
Patched Version
  • 5.4.7

Recent vulnerabilities in Ivory Search – WordPress Search Plugin

Ivory Search <= 5.5.15 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu_title' and 'menu_magnifier_color' Settings
4.4
CVE-2026-11356
Jun 26, 2026
Researcher: Meher Sudhakar Abbireddi
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
6.1
CVE-2024-13362
Apr 30, 2026
Researcher: Asaf Mozes
Ivory Search <= 5.5.13 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu_gcse' and 'nothing_found_text' Parameters
4.4
CVE-2026-1053
Jan 27, 2026
Researcher: JongHwan Shin (zzzsleep)
Ivory Search <= 5.5.12 - Missing Authorization
5.3
CVE-2025-63069
Sep 28, 2025
Researcher: Que Thanh Tuan - Blue Rock
Ivory Search – WordPress Search Plugin <= 5.5.9 - Authenticated (Admin+) Stored Cross-Site Scripting
4.4
CVE-2025-5209
May 27, 2025
Researchers:
Ivory Search – WordPress Search Plugin <= 5.5.6 - Information Exposure via AJAX Search Form
5.3
CVE-2024-6835
Sep 4, 2024
Researcher: stealthcopter
Ivory Search – WordPress Search Plugin <= 5.5.5 - Missing Authorization to Authenticated (Subscriber+) Index Creation
4.3
CVE-2024-3233
Apr 12, 2024
Researcher: Thura Moe Myint (mgthuramoemyint)
Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get
6.1
CVE-2023-33999
Jul 18, 2023
Researcher: Rafie Muhammad
Freemius SDK <= 2.4.2 - Missing Authorization Checks
6.3
CVE-2022-4974
Mar 4, 2022
Researchers:
Ivory Search <= 5.4 - Multiple Admin+ Stored Cross-Site Scripting
4.8
CVE-2021-25105
Jan 10, 2022
Researcher: R3N0
# Title CVE ID CVSS Researchers Date
1 Ivory Search <= 5.5.15 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu_title' and 'menu_magnifier_color' Settings CVE-2026-11356 4.4 Meher Sudhakar Abbireddi June 26, 2026
2 Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter CVE-2024-13362 6.1 Asaf Mozes April 30, 2026
3 Ivory Search <= 5.5.13 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu_gcse' and 'nothing_found_text' Parameters CVE-2026-1053 4.4 JongHwan Shin (zzzsleep) January 27, 2026
4 Ivory Search <= 5.5.12 - Missing Authorization CVE-2025-63069 5.3 Que Thanh Tuan - Blue Rock September 28, 2025
5 Ivory Search – WordPress Search Plugin <= 5.5.9 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2025-5209 4.4 May 27, 2025
6 Ivory Search – WordPress Search Plugin <= 5.5.6 - Information Exposure via AJAX Search Form CVE-2024-6835 5.3 stealthcopter September 4, 2024
7 Ivory Search – WordPress Search Plugin <= 5.5.5 - Missing Authorization to Authenticated (Subscriber+) Index Creation CVE-2024-3233 4.3 Thura Moe Myint (mgthuramoemyint) April 12, 2024
8 Freemius SDK <= 2.5.9 - Reflected Cross-Site Scripting via fs_request_get CVE-2023-33999 6.1 Rafie Muhammad July 18, 2023
9 Freemius SDK <= 2.4.2 - Missing Authorization Checks CVE-2022-4974 6.3 March 4, 2022
10 Ivory Search <= 5.4 - Multiple Admin+ Stored Cross-Site Scripting CVE-2021-25105 4.8 R3N0 January 10, 2022
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation