{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1053", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-16T16:57:13.383Z", "datePublished": "2026-01-28T08:26:55.731Z", "dateUpdated": "2026-04-08T17:24:13.183Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:24:13.183Z"}, "affected": [{"vendor": "vinod-dalvi", "product": "Ivory Search \u2013 WordPress Search Plugin", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.5.13", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Ivory Search \u2013 WordPress Search Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.5.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "title": "Ivory Search <= 5.5.13 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu_gcse' and 'nothing_found_text' Parameters", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cdc5ef6a-32d8-4c4b-b459-d9b543b56898?source=cve"}, {"url": "https://plugins.svn.wordpress.org/add-search-to-menu/tags/5.5.13/public/class-is-public.php"}, {"url": "https://plugins.trac.wordpress.org/browser/add-search-to-menu/tags/5.5.13/public/class-is-public.php#L204"}, {"url": "https://plugins.trac.wordpress.org/browser/add-search-to-menu/tags/5.5.13/public/class-is-public.php#L249"}, {"url": "https://plugins.trac.wordpress.org/browser/add-search-to-menu/tags/5.5.13/public/partials/is-ajax-results.php#L148"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3444659%40add-search-to-menu&new=3444659%40add-search-to-menu&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "baseScore": 4.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "JongHwan Shin"}], "timeline": [{"time": "2026-01-19T11:25:07.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-01-27T19:35:51.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-28T16:09:02.843440Z", "id": "CVE-2026-1053", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T16:09:19.903Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1053", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-28T16:09:02.843440Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-28T16:09:11.757Z"}}], "cna": {"title": "Ivory Search <= 5.5.13 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu_gcse' and 'nothing_found_text' Parameters", "credits": [{"lang": "en", "type": "finder", "value": "JongHwan Shin"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "vinod-dalvi", "product": "Ivory Search \u2013 WordPress Search Plugin", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "5.5.13"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-01-19T11:25:07.000+00:00", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-01-27T19:35:51.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cdc5ef6a-32d8-4c4b-b459-d9b543b56898?source=cve"}, {"url": "https://plugins.svn.wordpress.org/add-search-to-menu/tags/5.5.13/public/class-is-public.php"}, {"url": "https://plugins.trac.wordpress.org/browser/add-search-to-menu/tags/5.5.13/public/class-is-public.php#L204"}, {"url": "https://plugins.trac.wordpress.org/browser/add-search-to-menu/tags/5.5.13/public/class-is-public.php#L249"}, {"url": "https://plugins.trac.wordpress.org/browser/add-search-to-menu/tags/5.5.13/public/partials/is-ajax-results.php#L148"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3444659%40add-search-to-menu&new=3444659%40add-search-to-menu&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Ivory Search \u2013 WordPress Search Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.5.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-01-28T08:26:55.731Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1053", "state": "PUBLISHED", "dateUpdated": "2026-01-28T16:09:19.903Z", "dateReserved": "2026-01-16T16:57:13.383Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-01-28T08:26:55.731Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Ivory Search \u2013 WordPress Search Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.5.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled."}, {"lang": "es", "value": "El plugin Ivory Search \u2013 WordPress Search Plugin para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s de la configuraci\u00f3n de administrador en todas las versiones hasta la 5.5.13, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto hace posible que atacantes autenticados, con permisos de nivel de administrador y superiores, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada. Esto solo afecta a las instalaciones multisitio y a las instalaciones donde se ha deshabilitado unfiltered_html."}], "id": "CVE-2026-1053", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2026-01-28T09:15:48.980", "references": [{"source": "security@wordfence.com", "url": "https://plugins.svn.wordpress.org/add-search-to-menu/tags/5.5.13/public/class-is-public.php"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/add-search-to-menu/tags/5.5.13/public/class-is-public.php#L204"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/add-search-to-menu/tags/5.5.13/public/class-is-public.php#L249"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/add-search-to-menu/tags/5.5.13/public/partials/is-ajax-results.php#L148"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3444659%40add-search-to-menu&new=3444659%40add-search-to-menu&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/cdc5ef6a-32d8-4c4b-b459-d9b543b56898?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-15T18:58:46.891861+00:00", "value": {"mitigation_remediation": ["Upgrade Ivory Search to version 5.5.14 or later. This version removes the stored XSS flaw in the admin settings.", "If you cannot upgrade immediately, clear any custom values for the 'menu_gcse' and 'nothing_found_text' fields or replace them with plain text that contains no script tags or event attributes. Then resave the settings to ensure no malicious payload is stored.", "Deploy a Web Application Firewall rule or equivalent output\u2011escaping policy to strip or encode any JavaScript that might be inadvertently rendered by the plugin until a patch is applied."], "summary": {"action": "Patch", "impact": "Stored Cross\u2011Site Scripting"}, "threat_synthesis": {"affected_systems": "This flaw affects all versions of Ivory Search up to and including 5.5.13 installed on WordPress sites. The vendor, Vinod Dalvi, publishes the plugin under the name Ivory Search \u2013 WordPress Search Plugin. The vulnerability is relevant only in multi\u2011site WordPress installations where the unfiltered_html capability is disabled. Site owners running 5.5.13 or earlier should assume that using these admin options can store malicious code.", "description_and_impact": "The vulnerability is a stored Cross\u2011Site Scripting flaw in Ivory Search\u2019s admin settings, caused by inadequate input sanitization and output escaping of the 'menu_gcse' and 'nothing_found_text' parameters. An attacker who can log in with administrative or higher privileges can submit arbitrary JavaScript that is stored and then rendered on any site page that displays the modified settings. When a non\u2011privileged user views that page, the injected script runs in the victim\u2019s browser, potentially stealing session cookies, hijacking the user, or performing malicious actions on behalf of the user. This oversight violates CWE\u201179, leading to a moderate severity XSS risk. Only the content rendered by the plugin is affected; the core WordPress code remains unchanged.", "risk_and_exploitability": "The CVSS\u202fv3.1 base score is 4.4, indicating moderate impact. The EPSS score is below\u202f1\u202f%, showing a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, and no widespread exploitation has been reported. Attackers need authenticated administrator access on a multisite WordPress board that has unfiltered_html disabled. Once authenticated, they can craft a payload via the settings interface; the payload is then presented to all site visitors when the affected page renders, allowing a classic XSS attack flow. Because the exploit requires specific configuration and prior admin credentials, the overall threat remains moderate but non\u2011trivial for exposed sites."}}}}, "created": "2026-01-29T09:18:16.959385+00:00", "updated": "2026-04-15T19:00:12.319100+00:00", "vendors": ["vinod-dalvi", "vinod-dalvi$PRODUCT$ivory_search_\u2013_wordpress_search_plugin", "wordpress", "wordpress$PRODUCT$wordpress"]}