WordPress Ivory Search plugin <= 4.6.6 - Reflected Cross-Site Scripting (XSS) vulnerability
CVE-2021-36869

4.8MEDIUM

Key Information:

Vendor
Wordpress
Status
Ivory Search (WordPress Plugin)
Vendor
CVE Published:
21 October 2021

Summary

Reflected Cross-Site Scripting (XSS) vulnerability in WordPress Ivory Search plugin (versions <= 4.6.6). Vulnerable parameter: &post.

Affected Version(s)

Ivory Search (WordPress plugin) <= 4.6.6 <= 4.6.6

References

https://wordpress.org/plugins/add-search-to-menu/#developers
x_refsource_CONFIRM
https://patchstack.com/database/vulnerability/add-search-...
x_refsource_MISC

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Original researcher - Tien Nguyen Anh (Patchstack Red Team)
.