The Ivory Search – WordPress Search Plugin contains a stored XSS vulnerability due to insufficient input sanitization and output escaping in admin settings. Authenticated administrators can inject arbitrary web scripts that execute on page load in multi-site or restricted unfiltered_html environments. This vulnerability is tracked as CVE-2026-1053 and has a CVSS 3.1 base score of 4.4, indicating medium severity. No known exploits are reported in the wild, and no patch or remediation details are provided in the available data.

An attacker with administrator-level permissions can inject malicious scripts that execute in the context of users visiting the affected pages. This can lead to information disclosure or session hijacking limited to the scope of the affected WordPress installation. The impact is limited by the requirement for high privileges and specific WordPress configurations (multi-site or unfiltered_html disabled). There is no indication of availability impact or exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider monitoring for suspicious admin activity. Since this vulnerability requires administrator privileges and specific configurations, limiting high-level access reduces risk.