WordPress Ivory Search plugin <= 4.6.6 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Tien Nguyen Anh Patchstack Red Team in WordPress Ivory Search plugin versions = 4.6.6. Vulnerable at &post parameter. Solution Update the WordPress Ivory Search plugin to the latest available version at least 4.7...

Ivory Search < 4.7 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the post parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue. The data parameter was also affected, although it was not reported. PoC...

Ivory Search < 4.7 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the post parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting issue. The data parameter was also affected, although it was not reported...

WordPress Cross-Site Scripting Vulnerability (CNVD-2021-44303)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the Ivory Search WordPress plugin versions prior to...

Ivory Search Plugin for WordPress < 4.6.1 Cross-Site Scripting

The WordPress Ivory Search Plugin installed on the remote host is affected by a Cross-Site Scripting XSS vulnerability. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...

CVE-2021-24234

The Search Forms page of the Ivory Search WordPress lugin before 4.6.1 did not properly sanitise the tab parameter before output it in the page, leading to a reflected Cross-Site Scripting issue when opening a malicious crafted link as a high privilege user. Knowledge of a form id is required to...

CVE-2021-24234

CVE-2021-24234 affects the WordPress Ivory Search plugin prior to 4.6.1. The vulnerability is a reflected XSS caused by improper sanitization of the tab parameter in the Search Forms page, exploitable by sending a crafted link; knowledge of a form ID is required. Impact described in sources inclu...

CVE-2021-24234 Ivory Search < 4.6.1 - Reflected Cross Site Scripting (XSS)

The Search Forms page of the Ivory Search WordPress lugin before 4.6.1 did not properly sanitise the tab parameter before output it in the page, leading to a reflected Cross-Site Scripting issue when opening a malicious crafted link as a high privilege user. Knowledge of a form id is required to...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the Ivory Search WordPress plugin versions prior to...

Ivory Search < 4.6.1 - Reflected Cross Site Scripting (XSS)

The Search Forms page of the plugin did not properly sanitise the tab parameter before output it in the page, leading to a reflected Cross-Site Scripting issue when opening a malicious crafted link as a high privilege user. Knowledge of a form id is required to conduct the attack...

WordPress Ivory Search plugin <= 4.6 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Jinson Varghese Behanan in WordPress Ivory Search plugin versions = 4.6. Solution Update the WordPress Ivory Search plugin to the latest available version at least 4.6.1...

Ivory Search < 4.6.1 - Reflected Cross Site Scripting (XSS)

The Search Forms page of the plugin did not properly sanitise the tab parameter before output it in the page, leading to a reflected Cross-Site Scripting issue when opening a malicious crafted link as a high privilege user. Knowledge of a form id is required to conduct the attack. PoC...

Ivory Search < 4.5.11 - Authenticated Reflected Cross-Site Scripting (XSS)

The setting page of Ivory Search 4.5.10 is vulnerable to reflected XSS when a logged in administrator visit a malicious link or page, as it does not sanitise or escape the GET post parameter before outputting it in a tag attribute As an admin user, open:...

WordPress Ivory Search plugin <= 4.5.10 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability found by Nguyen Anh Tien in WordPress Ivory Search plugin versions = 4.5.10. Solution Update the WordPress Ivory Search plugin to the latest available version at least 4.5.11...

Ivory Search < 4.5.11 - Authenticated Reflected Cross-Site Scripting (XSS)

The setting page of Ivory Search 4.5.10 is vulnerable to reflected XSS when a logged in administrator visit a malicious link or page, as it does not sanitise or escape the GET post parameter before outputting it in a tag attribute PoC As an admin user, open:...