CVE-2025-5209: Ivory Search < 5.5.10 - Admin+ Stored XSS
Published Jun 17, 2025
·Updated
The Ivory Search WordPress plugin before 5.5.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed
Affected Software
2 affected components
Ivory Search Ivory Search<5.5.10
Ivorysearch Ivory Search Wordpress<5.5.10
Event History
Jun 17, 2025
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:15 AM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2025-5209?
CVE-2025-5209 has a medium severity rating due to its potential to allow Cross-Site Scripting (XSS) attacks for high privilege users.
2
How do I fix CVE-2025-5209?
To fix CVE-2025-5209, update the Ivory Search WordPress plugin to version 5.5.10 or later.
3
Who is affected by CVE-2025-5209?
CVE-2025-5209 affects users of the Ivory Search WordPress plugin prior to version 5.5.10.
4
What type of attack is associated with CVE-2025-5209?
CVE-2025-5209 is associated with Cross-Site Scripting (XSS) attacks.
5
Can CVE-2025-5209 be exploited if unfiltered_html is disallowed?
Yes, CVE-2025-5209 can still be exploited by high privilege users even when unfiltered_html is disallowed.