The Search Forms page of the Ivory Search WordPress lugin prior to 4.6.1 did not properly sanitise the tab parameter before output it in the page, leading to a reflected Cross-Site Scripting issue when opening a malicious crafted link as a high privilege user. Knowledge of a form id is required to conduct the attack.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|
Vulmon