WordPress Ivory Search Stored XSS via Input Sanitization Issues (CVE-2026-11356)

Vulnerability Overview Vulnerability Name: Ivory Search <= 5.5.15 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu_title' and 'menu_magnifier_color' Settings CVE ID: CVE-2026-11356 CVSS Score: 4.4 (Medium) Release Date: June 26, 2026 Last Updated: June 27, 2026 Researcher: Meher Sudhakar Abbireddi Affected Scope Software Type: Plugin Software Name: Ivory Search – WordPress Search Plugin Affected Versions: <= 5.5.15 Fixed Version: 5.5.16 Remediation Remediation Measure: Update to version 5.5.16 or a newer patched version. Vulnerability Description Ivory Search – WordPress Search Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'menu_title' and 'menu_magnifier_color' Settings in all versions up to, and including, 5.5.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Reference Links plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org plugins.trac.wordpress.org Share Options Facebook Twitter LinkedIn Email Additional Information Business Hours: 9am-8pm ET, 6am-5pm PT and 2pm-1am UTC/GMT excluding weekends and holidays. Response Time: 24-hour support, 365 days a year, with a 1-hour response time. Footer Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Social Media: X, Facebook, LinkedIn, Instagram Terms of Service: Terms of Service, Privacy Policy and Notice at Collection, Do Not Sell or Share My Personal Information Products & Support Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form Subscribe for Updates Subscribe: Sign up for news and updates from our panel of experienced security professionals. Email: you@example.com Agreement to Terms: By checking this box I agree to the terms of service and privacy policy. Subscribe Button SIGN UP Additional Information Business Hours: 9am-8pm ET, 6am-5pm PT and 2pm-1am UTC/GMT excluding weekends and holidays. Response Time: 24-hour support, 365 days a year, with a 1-hour response time. Footer Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Social Media: X, Facebook, LinkedIn, Instagram Terms of Service: Terms of Service, Privacy Policy and Notice at Collection, Do Not Sell or Share My Personal Information Products & Support Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form Subscribe for Updates Subscribe: Sign up for news and updates from our panel of experienced security professionals. Email: you@example.com Agreement to Terms: By checking this box I agree to the terms of service and privacy policy. Subscribe Button SIGN UP Additional Information Business Hours: 9am-8pm ET, 6am-5pm PT and 2pm-1am UTC/GMT excluding weekends and holidays. Response Time: 24-hour support, 365 days a year, with a 1-hour response time. Footer Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Social Media: X, Facebook, LinkedIn, Instagram Terms of Service: Terms of Service, Privacy Policy and Notice at Collection, Do Not Sell or Share My Personal Information Products & Support Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Response, Wordfence CLI, Wordfence Intelligence, Wordfence Central Support: Documentation, Learning Center, Free Support, Premium Support News: Blog, In The News, Vulnerability Advisories About: About Wordfence, Affiliate Program, Employment, Contact, Security, CVE Request Form Subscribe for Updates Subscribe: Sign up for news and updates from our panel of experienced security professionals. Email: you@example.com Agreement to Terms: By checking this box I agree to the terms of service and privacy policy. Subscribe Button SIGN UP Additional Information Business Hours: 9am-8pm ET, 6am-5pm PT and 2pm-1am UTC/GMT excluding weekends and holidays. Response Time: 24-hour support, 365 days a year, with a 1-hour response time. Footer Information Copyright: © 2012-2026 Defiant Inc. All Rights Reserved Social Media: X, Facebook, LinkedIn, Instagram Terms of Service: Terms of Service, Privacy Policy and Notice at Collection, Do Not Sell or Share My Personal Information Products & Support Products: Wordfence Free, Wordfence Premium, Wordfence Care, Wordfence Respo

Goal Reached Thanks to every supporter — we hit 100%!

WordPress Ivory Search Stored XSS via Input Sanitization Issues (CVE-2026-11356)

More from this source