Ivory Search < 5.5.10 – Admin+ Stored XSS | CVE 2025-5209

Description

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed

Proof of Concept

1. Started Burp Suite Community Edition with default settings, navigated to the Proxy > Intercept tab, opened the built-in browser, and logged in as the blog admin.
2. As blog admin go to `http://example.com/wp-admin/admin.php?page=ivory-search, clicked on Edit for the automatically generated AJAX Search Form and navigat to the AJAX settings.
3. In Burp Suite: set Intercept On
4. As blog admin: click on Save Form
5. In Burp Suite: edit the POST request body
Original: `...&_is_ajax%5Bmin_no_for_search%5D=1&...`
Edited: `...&_is_ajax%5Bmin_no_for_search%5D=1 onmouseover=alert(/XSS/)&...`
6. As network admin: added Shortcode for AJAX Search Form to a post
7. Now, upon visiting that post, the site triggers an alert moving the cursor over the search form