The vulnerability is a stored Cross‑Site Scripting flaw in Ivory Search’s admin settings, caused by inadequate input sanitization and output escaping of the 'menu_gcse' and 'nothing_found_text' parameters. An attacker who can log in with administrative or higher privileges can submit arbitrary JavaScript that is stored and then rendered on any site page that displays the modified settings. When a non‑privileged user views that page, the injected script runs in the victim’s browser, potentially stealing session cookies, hijacking the user, or performing malicious actions on behalf of the user. This oversight violates CWE‑79, leading to a moderate severity XSS risk. Only the content rendered by the plugin is affected; the core WordPress code remains unchanged.

This flaw affects all versions of Ivory Search up to and including 5.5.13 installed on WordPress sites. The vendor, Vinod Dalvi, publishes the plugin under the name Ivory Search – WordPress Search Plugin. The vulnerability is relevant only in multi‑site WordPress installations where the unfiltered_html capability is disabled. Site owners running 5.5.13 or earlier should assume that using these admin options can store malicious code.

The CVSS v3.1 base score is 4.4, indicating moderate impact. The EPSS score is below 1 %, showing a very low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, and no widespread exploitation has been reported. Attackers need authenticated administrator access on a multisite WordPress board that has unfiltered_html disabled. Once authenticated, they can craft a payload via the settings interface; the payload is then presented to all site visitors when the affected page renders, allowing a classic XSS attack flow. Because the exploit requires specific configuration and prior admin credentials, the overall threat remains moderate but non‑trivial for exposed sites.