CVE-2021-24234: ivorysearch ivory_search Cross-site Scripting
Vulnerability summary
CVE-2021-24234 is a medium (CVSS 6.1) Cross-site Scripting vulnerability in ivorysearch ivory_search. EPSS estimates a 1.17% chance of exploitation in the next 30 days, higher than 67% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 22-04-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
The Search Forms page of the Ivory Search WordPress lugin before 4.6.1 did not properly sanitise the tab parameter before output it in the page, leading to a reflected Cross-Site Scripting issue when opening a malicious crafted link as a high privilege user. Knowledge of a form id is required to conduct the attack.
CVSS metrics
3 scores · 2 sources · 2 versions- wordfenceSource6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
1.17%
Chance of exploitation in the next 30 days
Percentile
67%
Versus all other CVEs
30-day change
0.00 pp
From 1.17% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (wpscan.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Ivorysearch1 product
- ivory_search< 4.6.1
Unknown1 product
- ivory search – wordpress search plugin≥ 4.6.1, < 4.6.1
Wordpress1 product
- add-search-to-menu≤ 4.6 (fixed in 4.6.1)
3 vendors · 3 products
References
4 links- wpscan.com/vulnerability/ecc620be-8e29-4860-9d32-86b5814a3835X Refsource CONFIRMExploitThird Party Advisory
- www.getastra.com/blog/911/plugin-exploit/reflected-xss-vulnerability-in-ivory-search-wp-plugin/X Refsource MISCThird Party Advisory
- www.jinsonvarghese.com/reflected-xss-vulnerability-found-in-ivory-search-plugin/X Refsource MISCThird Party Advisory