CVE-2026-11356: Ivory Search WordPress Plugin Stored XSS Vulnerability

Technical summary

The vulnerability stems from inadequate input sanitization and output escaping in the Ivory Search plugin's settings handlers. Specifically, the 'menu_title' and 'menu_magnifier_color' parameters fail to properly escape user-supplied data before rendering it in the DOM. Because WordPress administrators have broad privileges, a compromised or malicious admin account can leverage this to store arbitrary JavaScript payloads that execute in the context of the WordPress admin panel and front-end pages. The issue is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation) and carries a CVSS v3.1 base score of 4.4 (MEDIUM severity).

Business impact

The risk is limited by the requirement for administrator-level access, which narrows the attack surface to insider threats or compromised admin accounts. However, if an attacker gains admin credentials—through credential stuffing, phishing, or supply-chain compromise—they can inject scripts that steal session tokens, redirect users, deface pages, or harvest sensitive data. For multi-user WordPress installations with delegated admin roles, this becomes a lateral movement vector. Sites relying on shared hosting or with weak password policies face elevated risk.

Affected systems

Ivory Search – WordPress Search Plugin, versions 5.5.15 and earlier. The vulnerability affects all installations of this plugin. Organizations should audit their WordPress plugin roster to identify whether Ivory Search is deployed and determine current plugin version.

Exploitability

Exploitation requires authenticated access with administrator privileges—a high barrier. The attack does not require user interaction (UI:N in the CVSS vector), meaning once the payload is stored, it executes automatically. An attacker with admin access can inject payloads at will. The network-based attack vector and high privilege requirement keep the base score moderate, but the cross-site scope (S:C) and persistent nature elevate operational concern.

Remediation

Update the Ivory Search plugin to a version newer than 5.5.15 that includes input sanitization and output escaping fixes. Verify the patched version against the plugin's official security advisory. As an interim measure, restrict administrator role assignments to trusted personnel, enforce strong password policies, enable two-factor authentication on admin accounts, and monitor plugin settings for unauthorized changes. Review access logs for suspicious admin logins.

Patch guidance

Check the Ivory Search plugin repository or the vendor's security advisory for the next available version after 5.5.15. Apply the update through WordPress's built-in plugin update mechanism or manually via SFTP. Test the update on a staging environment first to confirm no conflicts with your theme or other plugins. After patching, audit the two affected settings (menu_title, menu_magnifier_color) to confirm no injected content remains from a prior compromise.

Detection guidance

Review WordPress admin audit logs for changes to Ivory Search settings, particularly the menu_title and menu_magnifier_color fields. Look for entries containing script tags, event handlers (onclick, onerror), or encoded payloads. Use a Web Application Firewall (WAF) to detect and block reflected XSS attempts in plugin settings pages. Enable WordPress security plugins that monitor and alert on database changes involving serialized plugin options. Inspect browser console and network traffic on pages using Ivory Search for unexpected JavaScript execution.

Why prioritize this

Although the CVSS score is MEDIUM (4.4), prioritization should account for context: if your administrators use weak passwords, lack MFA, or operate in a high-phishing environment, the actual risk is elevated. The stored nature of the XSS means a single compromised admin account can affect all site visitors. However, if your WordPress user management is mature and accounts are well-protected, this can be addressed in a regular maintenance cycle. Prioritize immediately if you operate a high-traffic site, handle sensitive user data, or suspect any admin account compromise.

Risk score, explained

The CVSS v3.1 score of 4.4 reflects a MEDIUM severity issue constrained by high privilege requirements (PR:H) and high attack complexity (AC:H). The score does not account for the stored persistence of the payload or its cross-site scope; these factors increase operational risk beyond the numeric base score. The impact is confidentiality and integrity loss (C:L, I:L) with no availability impact (A:N). Organizations should weigh this baseline against their specific admin access controls and data sensitivity.

Frequently asked questions