CVE-2026-92243 describes a reflected cross-site scripting vulnerability in the Ivory Search WordPress plugin versions up to and including 5.5.18. The flaw exists due to improper neutralization of input in the 's' parameter used in search queries, which is insufficiently sanitized and escaped before being rendered. Attackers can exploit this by crafting malicious search queries that execute arbitrary scripts in the context of users who access the search results page, provided the 'Highlight Search Terms' option is enabled by an administrator and the query returns results.

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of users visiting the affected search results page. This can lead to information disclosure and limited integrity impacts, such as session hijacking or UI manipulation. There is no direct impact on availability. The vulnerability affects confidentiality and integrity to a limited extent.

No official patch or fix link is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider disabling the 'Highlight Search Terms' feature to mitigate the risk of exploitation. Monitoring vendor channels for updates is recommended.