Unknown Ivory Search – Wordpress Search Plugin vulnerabilities

2 vulnerabilities

Known vulnerabilities in Unknown Ivory Search – Wordpress Search Plugin, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.

4.8CVE-2021-25105ivorysearchivory_search+2
EPSS score
0.60%
The Ivory Search WordPress plugin before 5.4.1 does not escape some of the Form settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.6.1CVE-2021-24234ivorysearchivory_search+2
EPSS score
1.17%
The Search Forms page of the Ivory Search WordPress lugin before 4.6.1 did not properly sanitise the tab parameter before output it in the page, leading to a reflected Cross-Site Scripting issue when opening a malicious crafted link as a high privilege user. Knowledge of a form id is required to conduct the attack.