CVE-2026-11356 is a stored cross-site scripting vulnerability in the Ivory Search – WordPress Search Plugin caused by improper neutralization of input during web page generation. Specifically, the 'menu_title' and 'menu_magnifier_color' settings do not properly sanitize or escape input, enabling authenticated administrators to inject arbitrary web scripts. These scripts execute in the context of users who view the injected pages, potentially leading to data theft or session hijacking. The vulnerability affects all plugin versions up to and including 5.5.15. No official remediation or patch information is currently available.

An attacker with administrator-level access can inject malicious scripts that execute in the browsers of users who visit the affected pages. This can lead to limited confidentiality and integrity impacts, such as theft of user data or unauthorized actions performed on behalf of users. There is no impact on availability reported. The vulnerability requires high privileges and no user interaction is needed for exploitation once the script is injected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and review plugin settings for suspicious entries in 'menu_title' and 'menu_magnifier_color'. Consider disabling or removing the Ivory Search plugin if possible to reduce risk.