EUVD-2026-39931
GHSA-jwpp-v8v4-wh67
Severity by source
AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N
AC:L because injecting text into a settings field requires no technical complexity once admin access is obtained; UI:R because stored XSS impact materializes only when a victim browses to the affected page.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Ivory Search - WordPress Search Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'menu_title' and 'menu_magnifier_color' Settings in all versions up to, and including, 5.5.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
AnalysisAI
Stored cross-site scripting in Ivory Search - WordPress Search Plugin (all versions through 5.5.15) allows authenticated WordPress administrators to implant persistent JavaScript payloads via the menu_title and menu_magnifier_color settings fields, which execute in the browsers of any site visitor loading a page that renders the affected search widget. The root cause is insufficient input sanitization and output escaping in both the admin settings handler (class-is-settings-fields.php:249) and public-facing output routines (class-is-public.php:222, 263, 1199), confirmed via plugin source references on WordPress Trac. No public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, and the CVSS score of 4.4 reflects the high privilege prerequisite rather than the cross-site impact scope.
Technical ContextAI
The Ivory Search - WordPress Search Plugin (plugin slug: add-search-to-menu, CPE: cpe:2.3:a:vinod-dalvi:ivory_search_-_wordpress_search_plugin:*:*:*:*:*:*:*:*) provides configurable search menu functionality for WordPress sites. The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), the classic stored XSS root cause: attacker-controlled values are written to persistent storage without sanitization, then rendered back to end users without proper output escaping. The specific injection points are the menu_title and menu_magnifier_color fields within the plugin's settings interface, whose values are consumed in both the admin settings renderer (admin/class-is-settings-fields.php line 249) and public output functions (public/class-is-public.php lines 222, 263, and 1199). The WordPress plugin architecture means these settings are accessible through the standard WP admin dashboard and their output is embedded into public page HTML wherever the search widget is rendered.
RemediationAI
An upstream fix is confirmed by WordPress plugin repository changeset 3583051 (https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3583051%40add-search-to-menu&new=3583051%40add-search-to-menu); site operators should update the Ivory Search plugin to the first version released after 5.5.15 that incorporates this changeset, verifiable via the WordPress admin Updates panel or the plugin page at wordpress.org/plugins/add-search-to-menu - note that the exact released patched version number is not independently confirmed from available data. As a compensating control prior to updating, administrators should inspect the menu_title and menu_magnifier_color fields in the Ivory Search settings for any unexpected or script-containing values and clear them if present. Restricting the WordPress administrator role to the minimum number of necessary, trusted accounts limits the exploitable attack surface, as does enforcing multi-factor authentication on all admin accounts to reduce credential-based access risk. Temporarily deactivating the Ivory Search plugin eliminates the attack surface entirely but removes search functionality as a trade-off.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today