WordPress Ivory Search plugin < 5.5.10 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by WPscan in WordPress Plugin Ivory Search versions 5.5.10...

CVE-2025-5209

The Ivory Search WordPress plugin, in versions prior to 5.5.10 , contains a Stored Cross-Site Scripting (XSS) vulnerability. The root cause is the insufficient sanitization and escaping of certain plugin settings, which occurs even when unfiltered_html is disallowed. This flaw allows high-privile...

CVE-2025-5209 Ivory Search < 5.5.10 - Admin+ Stored XSS

The Ivory Search WordPress plugin before 5.5.10 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...