CVE-2026-1053: Ivory Search WordPress Plugin XSS Flaw

CVE-2026-1053 Overview

The Ivory Search – WordPress Search Plugin contains a stored Cross-Site Scripting (XSS) vulnerability affecting all versions through 5.5.13. The flaw stems from insufficient input sanitization and output escaping in the plugin's admin settings. Authenticated attackers with administrator-level privileges can inject arbitrary JavaScript that executes when any user visits an affected page. The vulnerability impacts only multi-site WordPress installations or environments where the unfiltered_html capability has been disabled. The issue is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated administrators on multi-site WordPress installations can store malicious scripts that execute in visitor browsers, enabling session theft and account takeover across the network.

Affected Products

Ivory Search – WordPress Search Plugin (add-search-to-menu) versions up to and including 5.5.13
WordPress multi-site network installations using the plugin
WordPress installations where unfiltered_html capability is disabled

Discovery Timeline

2026-01-28 - CVE-2026-1053 published to NVD
2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-1053

Vulnerability Analysis

The vulnerability resides in the Ivory Search plugin's admin settings handling logic. Administrator-supplied input flows from configuration fields to rendered output without proper sanitization or escaping. The affected code paths include public/class-is-public.php at lines 204 and 249, plus public/partials/is-ajax-results.php at line 148. When an administrator submits crafted payload data through the plugin settings, the values are persisted to the database and later echoed into page output. Any visitor who triggers a search render or visits an injected page executes the attacker's JavaScript within their browser session.

Root Cause

The plugin trusts administrator-supplied input and renders it without applying WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses(). WordPress normally permits administrators to embed raw HTML through the unfiltered_html capability, which mitigates this class of issue on standard single-site installs. However, on multi-site networks WordPress strips unfiltered_html from site administrators by default, and some hardened single-site environments also revoke it. In those contexts, the plugin's missing sanitization becomes exploitable.

Attack Vector

An attacker who obtains administrator credentials on an affected multi-site network submits a malicious script payload through one of the vulnerable settings fields. The payload is stored in the database via the plugin's options handler. When a user, including a higher-privileged super-admin, loads a page that renders the affected output, the script executes in their browser context. This enables session cookie theft, forced administrative actions through forged requests, and persistence of malicious code across the network. The high attack complexity reflects the prerequisite administrator access and the non-default configuration requirement.

Detection Methods for CVE-2026-1053

Indicators of Compromise

Unexpected <script>, <iframe>, or event-handler attributes (e.g., onerror=, onload=) stored in plugin options under the add-search-to-menu namespace in the wp_options or wp_sitemeta tables
Outbound requests from visitor browsers to unknown domains after loading pages that render Ivory Search output
New or modified administrator accounts created shortly after settings changes by an existing administrator

Detection Strategies

Audit the plugin's stored settings for HTML or JavaScript content using database queries against wp_options rows with the is_ prefix used by the plugin
Inspect WordPress audit logs for update_option events targeting Ivory Search configuration values
Scan rendered HTML output of pages containing search widgets for inline scripts that did not originate from the theme or core WordPress

Monitoring Recommendations

Enable a Web Application Firewall (WAF) with rules that detect script tags and JavaScript event handlers in administrative POST requests to wp-admin/admin.php with the plugin's settings page
Log and alert on all administrator-level logins to multi-site networks, particularly those followed by plugin configuration changes
Monitor Content Security Policy (CSP) violation reports for inline script execution on pages that render Ivory Search output

How to Mitigate CVE-2026-1053

Immediate Actions Required

Update the Ivory Search – WordPress Search Plugin to a version newer than 5.5.13 once a patched release is available from the vendor
Audit existing plugin settings on multi-site installations for stored HTML or JavaScript and remove suspicious content
Review the list of users holding administrator privileges and remove any unnecessary accounts

Patch Information

The vendor has committed a code change tracked in the WordPress Plugin Change Set for the add-search-to-menu repository. Refer to the Wordfence Vulnerability Report for the fixed version and additional remediation guidance. Apply updates through the WordPress admin dashboard or via wp-cli plugin update add-search-to-menu.

Workarounds

Deactivate the Ivory Search plugin on multi-site networks until a fixed version is deployed
Restrict administrative access through multi-factor authentication and limit administrator role assignments to trusted personnel
Deploy a Content Security Policy that disallows inline scripts on pages that include the search widget output

bash

# Configuration example: WP-CLI commands to audit and update the plugin
wp plugin list --name=add-search-to-menu --fields=name,status,version
wp option get is_settings --format=json | grep -iE '<script|onerror|onload'
wp plugin update add-search-to-menu
wp plugin deactivate add-search-to-menu --network  # temporary workaround on multi-site