The vulnerability is a stored XSS flaw in the Ivory Search plugin’s menu settings. An authenticated user with administrator or higher privileges can insert arbitrary JavaScript into the "menu_title" or "menu_magnifier_color" fields. When a page that uses those settings is loaded, the injected script runs in the victim’s browser. This enables the attacker to steal session cookies, deface the site, or redirect users to malicious sites. The likely attack vector is an authenticated administrator altering menu settings, which then propagates to all users who view the affected page.

The affected product is the Ivory Search – WordPress Search Plugin developed by vinod‑dalvi. All releases up to and including version 5.5.15 are vulnerable; versions 5.5.16 and later contain the fix.

The CVSS score of 4.4 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, so existing exploitation activity is unknown. Exploitation requires administrator access to the WordPress instance, after which the stored script is delivered to any visitor of the affected page. The plugin’s input validation lacks proper sanitization and output escaping, so the flaw is straightforward to exercise once permissions are granted.