Ivory Search <= 5.5.18 - Unauthenticated Reflected Cross-Site Scripting via Highlight Search Terms
- ID
- WPSEC-2026-0378
- Plugin
- Ivory Search – WordPress Search Plugin (add-search-to-menu)
- Affected
- from 4.0 before 5.5.19
- Remediation
- Update to 5.5.19 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin High · Affected versions High among sites WPSec scans, 2026-10-22
- Attack surface
- Ivory Search on WPSec AttackSurface
- Fix released
- Published
Description
The Ivory Search plugin for WordPress is vulnerable to DOM-based Cross-Site Scripting via the Highlight Search Terms feature in versions 4.0 up to, and including, 5.5.18. To highlight a search term, the plugin's is-highlight.js script rebuilt each matching text node as an HTML string and inserted it back into the page with jQuery, so text the page had already escaped, such as the search query shown on the search results page, was parsed again as markup. This makes it possible for unauthenticated attackers to inject arbitrary web scripts that execute if they can trick a user, such as an administrator, into clicking a crafted search link. The same flaw lets users with Contributor-level access or above place markup-like text in published posts that runs when a visitor's search matches it, on the search results page or in live (AJAX) search results. Exploitation requires the search term highlighting option to be enabled on a search form; it is off by default.
References
- https://wpsec.com/vuln/WPSEC-2026-0378/
- https://plugins.svn.wordpress.org/add-search-to-menu/tags/5.5.19/
- https://wordpress.org/plugins/add-search-to-menu/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS