Ivory Search < 5.4.7 - Reflected Cross-Site Scripting

The plugin does not escape some URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting PoC When the plugin displays the usage notice: https://example.com/wp-admin/plugins.php?"...

WordPress Ivory Search plugin <= 5.4.6 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress Ivory Search plugin versions = 5.4.6. Solution Update the WordPress Ivory Search plugin to the latest available version at least 5.4.7...

Wordpress Plugin Ivory Search Cross-Site Scripting Vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. cross-site scripting vulnerability exists in versio...

WordPress Ivory Search plugin < 5.4.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Ivory Search plugin versions 5.4.4. Solution Update the WordPress Ivory Search plugin to the latest available version at least 5.4.4...

WordPress Ivory Search plugin < 5.4.4 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Ivory Search plugin versions 5.4.4. Solution Update the WordPress Ivory Search plugin to the latest available version at least 5.4.4...

CVE-2021-25105

The Ivory Search WordPress plugin before 5.4.1 does not escape some of the Form settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-25105

The CVE-2021-25105 entry concerns the WordPress Ivory Search plugin prior to version 5.4.1, where Form settings are not properly escaped, enabling stored XSS by high-privilege users even when unfiltered_html is disallowed. Affected component: Ivory Search’s admin form handling (Form settings). Do...

CVE-2021-25105 Ivory Search < 5.4.1 - Multiple Admin+ Stored Cross-Site Scripting

The Ivory Search WordPress plugin before 5.4.1 does not escape some of the Form settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

Wordpress Plugin Ivory Search 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. WordPress plugin is a WordPress open source application plugin. cross-site scripting vulnerability exists in versio...

WordPress Ivory Search plugin <= 5.4 - Multiple Stored Cross-Site Scripting (XSS) vulnerability

Multiple Stored Cross-Site Scripting XSS vulnerabilities discovered by Yoru Oni in WordPress Ivory Search plugin versions = 5.4. Solution Update the WordPress Ivory Search plugin to the latest available version at least 5.4.1...

Ivory Search < 5.4.1 - Multiple Admin+ Stored Cross-Site Scripting

The plugin does not escape some of the Form settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Go to the AJAX settings of a Form and put the following payload in the "Minimum number of characters...

WordPress Ivory Search plugin <= 4.7 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability

Authenticated Persistent Cross-Site Scripting XSS vulnerability discovered in WordPress Ivory Search plugin versions = 4.7. Solution Update to the latest available version at least 4.7.1...

Ivory Search < 4.8 - Contributor+ Stored Cross-Site Scripting

The plugin dos not escape the id argument of its shortcode, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks As a contributor or above, put the following shortcode in a post/page ivory-search title="Some Form" id='1" onmouseover="alert/XSS/'...

CVE-2021-36869

Reflected Cross-Site Scripting XSS vulnerability in WordPress Ivory Search plugin versions = 4.6.6. Vulnerable parameter: &post...

CVE-2021-36869

Reflected Cross-Site Scripting XSS vulnerability in WordPress Ivory Search plugin versions = 4.6.6. Vulnerable parameter: &post...

Cross site scripting

Reflected Cross-Site Scripting XSS vulnerability in WordPress Ivory Search plugin versions = 4.6.6. Vulnerable parameter: &post...

CVE-2021-36869 WordPress Ivory Search plugin <= 4.6.6 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability in WordPress Ivory Search plugin versions = 4.6.6. Vulnerable parameter: &post...

CVE-2021-36869 WordPress Ivory Search plugin <= 4.6.6 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability in WordPress Ivory Search plugin versions = 4.6.6. Vulnerable parameter: &post...

CVE-2021-36869

CVE-2021-36869 affects WordPress Ivory Search plugin (versions ≤ 4.6.6). The vulnerability is a Reflected Cross‑Site Scripting (XSS) in the post parameter, caused by insufficient sanitization/escaping when outputting data in an attribute. Impact is XSS with potential client-side code execution as...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports personal blog sites on servers running PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin Ivory Search, which stems from the lack ...