CVE-2021-24234
Ivory Search < 4.6.1 - Reflected Cross Site Scripting (XSS)
- State
- Published
- Severity
- Not scored
- Published
- Apr 22, 2021
- Updated
- Aug 3, 2024
- Reserved
- Jan 14, 2021
Description
The Search Forms page of the Ivory Search WordPress lugin before 4.6.1 did not properly sanitise the tab parameter before output it in the page, leading to a reflected Cross-Site Scripting issue when opening a malicious crafted link as a high privilege user. Knowledge of a form id is required to conduct the attack.
Scores
The record has no CVSS score.
Weaknesses
- CWE-79 Cross-site Scripting (XSS)
Affected Products
| Product | Versions |
|---|---|
Ivory Search – WordPress Search PluginUnknown |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.