CVE-2026-11356: Ivory Search WordPress Plugin XSS Flaw

CVE-2026-11356 Overview

CVE-2026-11356 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Ivory Search – WordPress Search Plugin. The flaw affects all versions up to and including 5.5.15 and stems from insufficient input sanitization and output escaping on the menu_title and menu_magnifier_color plugin settings. Authenticated attackers with administrator-level access or above can inject arbitrary web scripts that execute whenever a user visits an affected page. The issue was reported through Wordfence and remediated in the plugin repository. The Wordfence Vulnerability Report ID ab004836 tracks the disclosure.

Critical Impact
An authenticated administrator can persist malicious JavaScript in plugin settings, causing script execution in the browsers of visitors and other privileged users viewing affected pages.

Affected Products

Ivory Search – WordPress Search Plugin, all versions through 5.5.15
WordPress sites using the add-search-to-menu plugin
Multi-user WordPress installations where administrator privileges are delegated

Discovery Timeline

2026-06-27 - CVE-2026-11356 published to the National Vulnerability Database
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-11356

Vulnerability Analysis

The vulnerability resides in the Ivory Search plugin's handling of two settings values: menu_title and menu_magnifier_color. These values are stored through the plugin's admin settings interface, then rendered into the public-facing search widget markup. Because the plugin fails to properly sanitize input on save and does not escape output when rendering, an attacker who supplies script payloads as setting values causes those payloads to persist in the WordPress options table. The stored script executes in the browser of any visitor who loads a page containing the widget.

Root Cause

The root cause is missing input sanitization and output escaping in the settings save path and the public rendering path. The admin settings registration in admin/class-is-settings-fields.php accepts the raw values, and the public class public/class-is-public.php outputs those values into HTML contexts without applying WordPress escaping helpers such as esc_attr() or esc_html(). Reviewers can inspect the affected code in the Plugin Settings Code and the public output at line 222, line 263, and line 1199.

Attack Vector

Exploitation requires an authenticated administrator session. The attacker navigates to the Ivory Search settings page and supplies a payload such as a script tag or event handler into menu_title or a crafted color value containing quote-breaking characters into menu_magnifier_color. The plugin stores the value in wp_options and echoes it into the rendered menu markup. Any user, including anonymous visitors, executes the injected script when loading pages that render the search widget. Because the attack requires high privileges, the primary abuse scenarios involve compromised administrator accounts, insider threats, or privilege delegation in multi-author environments.

Vulnerability mechanism (prose description - no verified PoC available):

1. Attacker with administrator role opens Ivory Search settings.
2. Attacker submits a payload in the menu_title or menu_magnifier_color field.
3. Plugin persists the raw value in the options table without sanitization.
4. Frontend rendering echoes the stored value into HTML without escaping.
5. Script executes in the browser context of every page visitor.

See the referenced source lines in the Wordfence report and Trac browser links
for the specific input handling and output paths.

Detection Methods for CVE-2026-11356

Indicators of Compromise

Unexpected <script>, onerror, or onload content stored in the wp_options row for Ivory Search settings
Outbound requests from visitor browsers to attacker-controlled domains originating on pages rendering the plugin widget
Modifications to plugin settings by administrator accounts outside change-management windows
Anomalous JavaScript executing in the DOM near the search menu element

Detection Strategies

Query the wp_options table for the Ivory Search settings keys and inspect stored values for HTML metacharacters or script fragments
Monitor WordPress audit logs for update_option events targeting the add-search-to-menu plugin
Deploy a Content Security Policy in report-only mode to surface inline script execution on pages hosting the widget
Use web application firewall rules to flag POST requests to the plugin settings endpoint containing <, >, or javascript: sequences

Monitoring Recommendations

Track administrator authentication events and correlate with subsequent plugin configuration changes
Alert on plugin file and option changes using file integrity monitoring and database change tracking
Review browser telemetry and RUM data for script errors or unexpected third-party script loads on public pages

How to Mitigate CVE-2026-11356

Immediate Actions Required

Upgrade the Ivory Search plugin to a version later than 5.5.15 that contains the sanitization fix
Audit existing menu_title and menu_magnifier_color values and remove any content containing HTML or script fragments
Rotate credentials for administrator accounts and enforce multi-factor authentication to reduce the risk of a compromised admin injecting stored XSS
Review the WordPress audit trail for unauthorized settings changes since the plugin was installed

Patch Information

The plugin authors released a fix tracked in the WordPress Plugin Changeset Overview. Compare the settings handling at v5.5.15 settings code with earlier revisions to confirm the sanitization changes before upgrading production sites.

Workarounds

Restrict the Ivory Search settings screen to a minimal set of trusted administrators using role management plugins or custom capability checks
Deploy a strict Content Security Policy that disallows inline scripts on pages rendering the search widget
Temporarily deactivate the plugin on high-traffic public sites until the patched version is deployed

bash

# Example: identify the installed Ivory Search version using WP-CLI
wp plugin get add-search-to-menu --field=version

# Update the plugin to the latest available release
wp plugin update add-search-to-menu

# Inspect stored settings for suspicious content
wp option get is_settings --format=json | grep -Ei 'script|onerror|onload|javascript:'