CVE-2021-25105

4.8 mediumEPSS 0.6%

Medium (4.8) in ivorysearch ivory search. EPSS 0.6% chance of exploitation in the next 30 days.

The Ivory Search WordPress plugin before 5.4.1 does not escape some of the Form settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.

Severity

CVSS 3.1

4.8 medium

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS: 0.6% chance of exploitation in the next 30 days; higher than 48% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2022-02-07
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

ivorysearch:ivory_search

References

https://wpscan.com/vulnerability/a9ab9e84-7f5e-4e7c-8647-114d9e02e59f
https://wpscan.com/vulnerability/a9ab9e84-7f5e-4e7c-8647-114d9e02e59f

Check your stack JSON