CVE detail
CVE-2026-11356
The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'menu_title' and 'menu_magnifier_color' Settings in all versions up to, and including, 5.5.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 24.9 · diversity 11.5 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 1
- within the 30d window
- Peak daily
- 1
- highest bucket
Evidence
Source links by recency
11 source links · newest first
- Wordfence Intelligence Weekly WordPress Vulnerability Report (June 22, 2026 to June 28, 2026)Wordfence
SMTP HD Quiz 2.2.0 - 2.2.1 - Cross-Site Request Forgery via Multiple AJAX Handlers 4.3 CVSS Rating 4.3 (Medium) CVE-ID CVE-2026-13422 Patch Status Patched Published Jun 26, 2026 Affected Software HD Quiz [hd-quiz] Researcher Wordfence PRISM More Details > Live Copy Paste for Elementor – Cross Domain Copy Paste & Page Duplicator Majestic Support – The
vendorwww.wordfence.comJul 2, 2026, 6:34 PM - https://www.wordfence.com/threat-intel/vulnerabilities/id/ab004836-8362-46d6-acfc-80f582605b43?source=cvewww.wordfence.com
No excerpt available.
Patchwww.wordfence.comJun 27, 2026, 2:16 AM - https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3583051%40add-search-to-menu&new=3583051%40add-search-to-menu&sfp_email=&sfph_mail=plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJun 27, 2026, 2:16 AM - https://plugins.trac.wordpress.org/browser/add-search-to-menu/tags/5.5.15/public/class-is-public.php#L263plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJun 27, 2026, 2:16 AM - https://plugins.trac.wordpress.org/browser/add-search-to-menu/tags/5.5.15/public/class-is-public.php#L222plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJun 27, 2026, 2:16 AM - https://plugins.trac.wordpress.org/browser/add-search-to-menu/tags/5.5.15/public/class-is-public.php#L1199plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJun 27, 2026, 2:16 AM - https://plugins.trac.wordpress.org/browser/add-search-to-menu/tags/5.5.15/admin/class-is-settings-fields.php#L249plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJun 27, 2026, 2:16 AM - https://plugins.trac.wordpress.org/browser/add-search-to-menu/tags/5.5.14/public/class-is-public.php#L263plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJun 27, 2026, 2:16 AM - https://plugins.trac.wordpress.org/browser/add-search-to-menu/tags/5.5.14/public/class-is-public.php#L222plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJun 27, 2026, 2:16 AM - https://plugins.trac.wordpress.org/browser/add-search-to-menu/tags/5.5.14/public/class-is-public.php#L1199plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJun 27, 2026, 2:16 AM - https://plugins.trac.wordpress.org/browser/add-search-to-menu/tags/5.5.14/admin/class-is-settings-fields.php#L249plugins.trac.wordpress.org
No excerpt available.
Patchplugins.trac.wordpress.orgJun 27, 2026, 2:16 AM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-66390CVSS 6.1 · Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Wicket. This issue affects Apache Wicket: from 9.0.0 through 9.23.0,…
- CVE-2026-66396CVSS 9.3 · Critical
SiYuan before v3.7.2 fails to escape the title-img Individual Attribute List value when rendering Gallery and Kanban cover images, allowing stored cross-site scripting via unescap…
- CVE-2026-66395CVSS 9.4 · Critical
SiYuan desktop before v3.7.2 contains a reflected cross-site scripting vulnerability in the bazaar plugin readme handler that allows attackers to execute arbitrary code by craftin…
- CVE-2026-66394CVSS 9.3 · Critical
SiYuan before v3.7.3 contains stored and reflected cross-site scripting vulnerabilities in SVG sanitization that allows authenticated attackers to execute scripts by bypassing the…
- CVE-2026-66475CVSS 5.9 · Medium
Shop manager Cross Site Scripting (XSS) in Checkout Field Editor for WooCommerce – Checkout Manager <= 3.0.5 versions.
- CVE-2026-66448CVSS 6.5 · Medium
Contributor Cross Site Scripting (XSS) in Gallery PhotoBlocks <= 1.3.3 versions.