Ivory Search < 4.6.1 - Reflected Cross Site Scripting (XSS)

The Search Forms page of the plugin did not properly sanitise the tab parameter before output it in the page, leading to a reflected Cross-Site Scripting issue when opening a malicious crafted link as a high privilege user. Knowledge of a form id is required to conduct the attack.

PoC

https://example.com/wp-admin/admin.php?page=ivory-search&amp;post;=&amp;action;=edit&amp;tab;=excludes"><img+src+onerror%3Dalert(%2FXSS%2F)>