CVE-2026-11356

MediumCVSS 4.4/10Last modified Jun 29, 2026

Description

The Ivory Search – WordPress Search Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'menu_title' and 'menu_magnifier_color' Settings in all versions up to, and including, 5.5.15 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

VendorProductVersions
vinod-dalviIvory Search – WordPress Search Plugin<= 5.5.15

References

Timeline

Published
Jun 27, 2026
Last modified
Jun 29, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-1135607.7Audition is affected by an Incorrect Authorization vulnerability that could result in arbitrary code execution in the context of the currentCVE-2026-1135627.7Audition is affected by an Improper Input Validation vulnerability that could result in arbitrary code execution in the context of the curreCVE-2026-1135638.6Audition is affected by a Violation of Secure Design Principles vulnerability that could result in arbitrary code execution in the context oCVE-2026-1135657.8Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current useCVE-2026-1135677.8Audition is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current useCVE-2026-1135695.5Photoshop Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attackerCVE-2026-113574.3The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to Sensitive Information Exposure in all vCVE-2026-1135715.5Photoshop Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attackerCVE-2026-1135725.9CAI Content Credentials is affected by a Use of a Broken or Risky Cryptographic Algorithm vulnerability that could result in a Security featCVE-2026-1135735.9CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attackeCVE-2026-1135744.0CAI Content Credentials is affected by an Uncontrolled Resource Consumption vulnerability that could lead to application denial-of-service. CVE-2026-1135757.8Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of
CVE-2026-11356: Medium severity, CVSS 4.4 | Vulnix