A serious XSS vulnerability existed in the WordPress search plugin Ivory Search. Exploiting the bug could let an adversary execute malicious code on the target website. Given the number of active installations of the plugin, this now-patched vulnerability potentially risked over 60,000 websites.
Ivory Search WordPress Plugin Vulnerability
Researchers from Astra Security Threat Intelligence Team found reflected cross-site scripting (XSS) vulnerability in the Ivory Search WordPress plugin.
Reflected XSS vulnerabilities affect the web applications allowing an adversary to execute malicious codes at the client side. For instance, a malicious code may execute when a user visits the infected web page.
As elaborated in their post, the team led by Jinson Varghese found an improper validation issue with the plugin. Explaining the problem, Varghese stated,
A particular component on the Ivory Search plugin settings page was not validated properly which enabled the execution of malicious JavaScript code.
The researchers have labeled it a medium-severity bug allowing an adversary to “perform malicious actions” on a target website.
Patch Deployed
Astra Security team found the vulnerability on March 28, 2021, affecting the Ivory Search plugin version 4.6.0 and below.
Consequently, the team reached out to the plugin developers to report the bug on the same day.
In response, the plugin’s team swiftly acted to address the vulnerability, and, on March 30, 2021, they released the fix with version 4.6.1. They have also acknowledged the bug fix in the changelog given on the plugin page.
The current Ivory Search plugin version is 4.6.2. Therefore, all users of this plugin must ensure updating their websites with version 4.6.1 or above to stay safe.
Recently, multiple XSS vulnerabilities affecting the Elementor plugin also caught attention. Those bugs had an even more severe impact given their extensive number of installations globally (7+ million). Hence, here we remind all WordPress users to ensure addressing this problem as well when updating their websites.