CVE-2026-92243 vinod-dalvi CVE debrief

Who should care

Defenders responsible for WordPress installations using the Ivory Search – WordPress Search Plugin should assess exposure and prioritize verification of the 'Highlight Search Terms' option and plugin updates.

Why it matters

The Ivory Search – WordPress Search Plugin vulnerability allows unauthenticated attackers to inject arbitrary web scripts, requiring defenders to verify the 'Highlight Search Terms' option and update the plugin.

• Defenders must verify the 'Highlight Search Terms' option is not enabled on search forms using the Ivory Search – WordPress Search Plugin.
• Defenders should ensure the plugin is updated to a version that addresses this vulnerability.
• Successful exploitation could allow unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Technical summary

The Ivory Search – WordPress Search Plugin is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versions up to, and including, 5.5.18 due to insufficient input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, but only if the targeted search form has the 'Highlight Search Terms' option enabled by an administrator, and that the malicious search query returns at least one post result.

Defensive priority

Defenders should prioritize verifying the 'Highlight Search Terms' option is not enabled on search forms using the Ivory Search – WordPress Search Plugin, and ensure the plugin is updated to a version that addresses this vulnerability.

Recommended defensive actions

• Verify the 'Highlight Search Terms' option is not enabled on search forms using the Ivory Search – WordPress Search Plugin
• Ensure the plugin is updated to a version that addresses this vulnerability
• Monitor search form usage and user access for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and references to source code. The Ivory Search – WordPress Search Plugin vulnerability allows unauthenticated attackers to inject arbitrary web scripts, requiring defenders to verify the 'Highlight Search Terms' option and update the plugin. Defenders should verify the 'Highlight Search Terms' option is not enabled on search forms using the Ivory Search – WordPress Search Plugin and ensure the plugin is updated to a version that

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.