CVE-2026-1053

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 5.5.13 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Jan 28, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-105305.3The Pie Register WordPress plugin before 3.8.4.10 does not use sufficiently random values when generating its account verification tokens, CVE-2026-1053025.7A flaw was found in the User Session Note mapper of the Keycloak identity and access management solution. The issue occurs because the mappe CVE-2026-1053055.4A flaw was found in the OIDC implementation of Keycloak, specifically within the Device Authorization Grant flow. This component allows devi CVE-2026-1053066.5A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the CVE-2026-1053077.3A vulnerability was detected in Casdoor up to 3.161.1. Affected is the function ApiFilter of the file routers/authz_filter.go of the compone CVE-2026-105315.4The AI Share & Summarize WordPress plugin before 2.0.4 does not sanitise and escape some of its shortcode attributes before outputting them CVE-2026-1053117.7The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console custom resource can set s CVE-2026-1053129.9A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an arbitrary container imag CVE-2026-1053147.5Papermerge 3.5.3 allows remote code execution by a standard user via directory traversal in a /api/documents/upload call. A Python .pth file CVE-2026-1053154.7A vulnerability has been found in django-haystack up to 3.3.0. Affected is the function _to_python of the file haystack/backends/elasticsear CVE-2026-1053167.1The Magee Shortcodes WordPress plugin through 2.1.1 does not sanitise and escape user input in some of its AJAX actions, which are available CVE-2026-1053178.5Subscriber SQL Injection in Paid Member Subscriptions <= 3.1.1 versions.