CVE-2026-11356 is a stored cross-site scripting vulnerability in the Ivory Search – WordPress Search Plugin affecting all versions up to and including 5.5.15. The issue stems from improper neutralization of input during web page generation, specifically in the 'menu_title' and 'menu_magnifier_color' settings. Authenticated attackers with administrator privileges can inject malicious scripts that execute in the context of users visiting the injected pages. This vulnerability is classified under CWE-79 and has a CVSS 3.1 base score of 4.4 (medium severity). No official patch or remediation level has been provided in the available data.

An attacker with administrator-level access can exploit this vulnerability to inject and execute arbitrary scripts in the context of users viewing affected pages. This can lead to limited confidentiality and integrity impacts, such as session hijacking or unauthorized actions performed on behalf of users. There is no indication of availability impact. The vulnerability requires high privileges and no user interaction is needed for exploitation once the malicious script is injected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and consider disabling or limiting use of the affected settings ('menu_title' and 'menu_magnifier_color') if possible. Monitor vendor channels for updates or patches addressing this vulnerability.