Vulnerabilities

TI-2025-04675 CVE-2025-5209 · GHSA-5j6c-8mh7-5662

Ivory Search < 5.5.10 - Admin+ Stored XSS

MEDIUM 55

The Ivory Search WordPress plugin before 5.5.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00256 Published 2025-06-17 Fixed in 5.5.10 CWE-79

TI-2024-06338 CVE-2024-6835 · GHSA-8g6h-qpgr-rm99

Ivory Search – WordPress Search Plugin <= 5.5.6 - Information Exposure via AJAX Search Form

LOW 31

The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 5.5.6 via the ajax_load_posts function.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00524 Published 2024-09-05 No fix listed CWE-200

TI-2021-07383 CVE-2021-25105 · GHSA-mr9w-hm8q-hjg9

Ivory Search < 5.4.1 - Multiple Admin+ Stored Cross-Site Scripting

LOW 23

The Ivory Search WordPress plugin before 5.4.1 does not escape some of the Form settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallo…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00598 Published 2022-02-07 Fixed in 5.4.1 CWE-79

TI-2021-14961 CVE-2021-36869 · GHSA-5g3x-85qh-f5cx

WordPress Ivory Search plugin <= 4.6.6 - Reflected Cross-Site Scripting (XSS) vulnerability

LOW 29

Reflected Cross-Site Scripting (XSS) vulnerability in WordPress Ivory Search plugin (versions <= 4.6.6).

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00755 Published 2021-10-21 No fix listed CWE-79

TI-2021-06526 CVE-2021-24234 · GHSA-6g4w-5pr9-j65h

Ivory Search < 4.6.1 - Reflected Cross Site Scripting (XSS)

LOW 30

The Search Forms page of the Ivory Search WordPress lugin before 4.6.1 did not properly sanitise the tab parameter before output it in the page, leading to a reflected Cross-Site Scripting issue when opening a malicious…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01173 Published 2021-04-22 Fixed in 4.6.1 CWE-79