Ivory Search EUVD-2026-91880

Exploitation requires THREE specific conditions, all drawn from the description: (1) the plugin's 'Highlight Search Terms' option must be explicitly enabled by an administrator - this is a non-default feature, so sites without it are not vulnerable; (2) the attacker-supplied search query in the 's' parameter must return at least one matching published post, otherwise the payload is not reflected in the highlight path; and (3) a victim must be socially engineered into opening the crafted search URL (UI:R). These factors - operator-enabled configuration, content-dependent reflection, and required user interaction - substantially limit realistic exploitation despite the unauthenticated network vector.

This is a textbook reflected XSS (CWE-79) carrying a MEDIUM severity rating (CVSS 6.1, CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The network vector and lack of required privileges (PR:N) make it reachable by unauthenticated remote attackers, but several signals temper the real-world risk. UI:R means a victim must be lured into clicking a crafted link, so there is no self-propagating or automatable mass-exploitation path. More importantly, the description adds two preconditions NOT reflected in the CVSS vector: the targeted search form must have the non-default 'Highlight Search Terms' option enabled by an administrator, AND the malicious query must return at least one post result. These constraints make the effective attack complexity higher than the AC:L in the official vector suggests - reflected XSS in a non-default, result-dependent code path is meaningfully narrower than a default-config bug. No EPSS score, no KEV listing, and no public POC were provided, so there is no evidence of active or impending exploitation; this reads as a routine advisory-driven finding rather than an urgent priority. Signal conflict to note: the official AC:L does not account for the config/result preconditions in the description - a defender should treat practical exploitability as lower than the raw score implies.

On a WordPress site running Ivory Search ≤5.5.18 with the 'Highlight Search Terms' option enabled, an attacker crafts a URL with a malicious payload in the 's' search parameter that also matches at least one published post. The attacker distributes this link (e.g., via phishing or a malicious post/comment); when a victim clicks it, the unsanitized search term is reflected and the injected script executes in the victim's browser session. No public exploit code was identified in the provided data.