CVE-2026-1053

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in the Ivory Search – WordPress Search Plugin (versions up to and including 5.5.13). The flaw stems from insufficient input sanitization and output escaping in admin settings, as evidenced in the plugin's code [1].

Exploitation

Exploitation requires authentication with administrator-level permissions. The attack surface is limited to multi-site WordPress installations or sites where the unfiltered_html capability has been disabled. An attacker can inject arbitrary web scripts through admin settings, which are stored and later executed when any user visits an affected page.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, data exfiltration, defacement, or other malicious actions, depending on the attacker's objectives.

Mitigation

As of the publication date, no patched version has been released. Users should monitor the plugin's repository for updates. In the interim, restrict administrator access to trusted users, and consider enabling unfiltered_html on non-multi-site installations where feasible.