CVE-2026-92243: Ivory Search <= 5.5.18 - Reflected DOM-Based Cross-Site Scripting via 's' Parameter
The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 5.5.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that the targeted search form has the 'Highlight Search Terms' option enabled by an administrator, and that the malicious search query returns at least one post result.
Affected Software
Event History
Frequently Asked Questions
Which installations are exposed to exploitation?
Installations running Ivory Search versions up to and including 5.5.18 are exposed only where an administrator has enabled the affected search form's "Highlight Search Terms" option. A malicious query must also return at least one post result.
Does an attacker need an account or other privileges?
No. The issue can be exploited by an unauthenticated attacker, but it requires user interaction: a user must access the page containing the injected search query.
What is the immediate mitigation if updating is not possible?
Disable the "Highlight Search Terms" option on affected Ivory Search forms. This removes a stated prerequisite for exploitation.
How can I determine whether an instance is affected?
Check whether Ivory Search is version 5.5.18 or earlier and whether "Highlight Search Terms" is enabled for a search form. Also confirm that the form can return post results, which is required for the malicious query to execute.