Known vulnerabilities in Ivory Search – WordPress Search Plugin

Advanced WordPress custom search plugin. Provides Search Form Customizer, WooCommerce Search, AJAX Search & Live Search support!

10Reported vulnerabilities

6.4Highest CVSS score

5.5.16Latest version

100,000+Active installs

What to do now

Update Ivory Search – WordPress Search Plugin to 5.5.16 or later. 10 of these have a fixed version available. Updating resolves them.

Plugin last updated: June 23, 2026 / Tested up to WordPress: 7.0.4 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVE	Severity	Exploit probability next 30 days	Affected versions	Fixed in	Published
WF-35b9f37c-69e1-437a-97dd-3d3e7a8cd86e	Medium 6.4	—	4.7.1 and earlier	`4.8`	November 2, 2021
CVE-2021-36869	Medium 6.1	0.8%	4.6.6 and earlier	`4.7`	October 21, 2021
CVE-2024-13362	Medium 6.1	0.3%	0 to 1.8.4.8.1 (inclusive) 0 to 1.0.4 (inclusive) 0 to 1.0.40 (inclusive) 0 to 1.1.3 (inclusive) 0 to 1.1.5 (inclusive) 0 to 1.1.13 (inclusive) 0 to 1.1.16 (inclusive) 0 to 1.2.6 (inclusive) 0 to 1.2.7 (inclusive) 0 to 1.2.7 (inclusive) 0 to 1.2.56 (inclusive) 0 to 1.3.1 (inclusive) 0 to 1.3.3 (inclusive) 0 to 1.3.4 (inclusive) 0 to 1.4.0 (inclusive) 0 to 1.4.2 (inclusive) 0 to 1.4.7 (inclusive) 0 to 1.4.9 (inclusive) 0 to 1.5.5 (inclusive) 0 to 1.5.8 (inclusive) 0 to 1.5.8 (inclusive) 0 to 1.5.10 (inclusive) 0 to 1.5.140 (inclusive) 0 to 1.6.0 (inclusive) 0 to 1.6.0 (inclusive) 0 to 1.6.3 (inclusive) 0 to 1.6.3 (inclusive) 0 to 1.6.3.2 (inclusive) 0 to 1.6.6 (inclusive) 0 to 1.6.22 (inclusive) 0 to 1.7 (inclusive) 0 to 1.7 (inclusive) 0 to 1.7.0 (inclusive) 0 to 1.7.0 (inclusive) 0 to 1.7.2 (inclusive) 0 to 1.7.34 (inclusive) 0 to 1.8.5 (inclusive) 0 to 1.8.99 (inclusive) 0 to 1.9.0 (inclusive) 0 to 1.9.0 (inclusive) 0 to 1.9.2 (inclusive) 0 to 1.9.4 (inclusive) 0 to 1.9.8 (inclusive) 0 to 1.10.4 (inclusive) 0 to 1.10.6 (inclusive) 0 to 1.13.15 (inclusive) 0 to 1.16.3 (inclusive) 0 to 2.0.0 (inclusive) 0 to 2.0.2 (inclusive) 0 to 2.0.7.2 (inclusive) 0 to 2.0.82 (inclusive) 0 to 2.1 (inclusive) 0 to 2.1.0 (inclusive) 0 to 2.1.5 (inclusive) 0 to 2.1.6 (inclusive) 0 to 2.1.34 (inclusive) 0 to 2.2.0 (inclusive) 0 to 2.2.2 (inclusive) 0 to 2.2.27 (inclusive) 0 to 2.2.38 (inclusive) 0 to 2.3.0 (inclusive) 0 to 2.3.1 (inclusive) 0 to 2.3.4 (inclusive) 0 to 2.3.7 (inclusive) 0 to 2.3.11 (inclusive) 0 to 2.4.1 (inclusive) 0 to 2.4.1 (inclusive) 0 to 2.4.2 (inclusive) 0 to 2.4.27 (inclusive) 0 to 2.5.5 (inclusive) 0 to 2.5.7 (inclusive) 0 to 2.5.8 (inclusive) 0 to 2.5.9 (inclusive) 0 to 2.5.9 (inclusive) 0 to 2.6.0 (inclusive) 0 to 2.6.0 (inclusive) 0 to 2.6.5 (inclusive) 0 to 2.6.7 (inclusive) 0 to 2.07 (inclusive) 0 to 2.7.0 (inclusive) 0 to 2.7.33 (inclusive) 0 to 2.8.4 (inclusive) 0 to 2.8.6 (inclusive) 0 to 2.9.2 (inclusive) 0 to 2.9.7 (inclusive) 0 to 2.16.3.3 (inclusive) 0 to 2.24.6 (inclusive) 0 to 2.25.16 (inclusive) 0 to 3.0.0 (inclusive) 0 to 3.0.2 (inclusive) 0 to 3.0.5 (inclusive) 0 to 3.0.6 (inclusive) 0 to 3.1.26 (inclusive) 0 to 3.1.28 (inclusive) 0 to 3.2.2 (inclusive) 0 to 3.2.4 (inclusive) 0 to 3.2.4.4 (inclusive) 0 to 3.2.6 (inclusive) 0 to 3.2.6 (inclusive) 0 to 3.2.7 (inclusive) 0 to 3.2.7 (inclusive) 0 to 3.2.8 (inclusive) 0 to 3.3.0 (inclusive) 0 to 3.3.2 (inclusive) 0 to 3.3.7 (inclusive) 0 to 3.4.9 (inclusive) 0 to 3.4.12 (inclusive) 0 to 3.5.1 (inclusive) 0 to 3.7.3 (inclusive) 0 to 3.8.3 (inclusive) 0 to 3.9.6 (inclusive) 0 to 3.12 (inclusive) 0 to 3.12.0 (inclusive) 0 to 3.12.1 (inclusive) 0 to 4.2.0 (inclusive) 0 to 4.4.1 (inclusive) 0 to 4.5.0 (inclusive) 0 to 4.6.8 (inclusive) 0 to 5.0.57 (inclusive) 0 to 5.3.4 (inclusive) 0 to 5.5.8 (inclusive) 0 to 5.5.31 (inclusive) 0 to 5.17.2 (inclusive) 0 to 5.222 (inclusive) 0 to 6.0.2 (inclusive) 0 to 6.1.10 (inclusive) 0 to 6.1.13 (inclusive) 0 to 6.6.5 (inclusive) 0 to 7.3.3 (inclusive) 0 to 7.7.0 (inclusive) 0 to 8.0.7 (inclusive)	`3.4.15`	May 1, 2026
WF-a1513296-f7f6-468c-ac96-5f55812d943e	Medium 6.1	—	5.4.6 and earlier	`5.4.7`	July 4, 2022
WF-6da0a85d-0c6f-40ae-8a3d-85222f0e7cc5	Medium 6.1	—	4.5.10 and earlier	`4.5.11`	February 1, 2021
CVE-2024-6835	Medium 5.3	0.5%	Before 5.5.7	`5.5.7`	September 5, 2024
CVE-2025-63069	Medium 5.3	0.3%	5.5.12 and earlier	`5.5.13`	September 28, 2025
CVE-2026-11356	Medium 4.4	0.4%	0 to 5.5.15 (inclusive)	`5.5.16`	June 27, 2026
CVE-2026-1053	Medium 4.4	0.3%	0 to 5.5.13 (inclusive)	`5.5.14`	January 28, 2026
CVE-2024-3233	Medium 4.3	0.4%	0 to 5.5.5 (inclusive) 0 to 5.5.5 (inclusive)	`5.5.6`	May 2, 2024

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.