Ivory Search – WordPress Search Plugin Security & Risk Analysis

The "add-search-to-menu" plugin, version 5.5.14, exhibits a mixed security posture. While it shows strengths in database query sanitization with 97% prepared statements and a high rate of output escaping (82%), significant concerns arise from its attack surface. A substantial portion of its entry points, specifically 4 out of 5, lack proper authentication checks. This is further compounded by 4 identified flows with unsanitized paths during taint analysis, although no critical or high severity issues were found in this specific analysis. The plugin's vulnerability history is a major red flag, with a total of 11 known medium-severity CVEs, including past instances of Cross-site Scripting, Sensitive Information Exposure, and Missing Authorization. The fact that the last vulnerability was in 2026, while the current version is 5.5.14 (which suggests it might be a future version or the vulnerability data is from a future context, but the principle of past issues remains), highlights a recurring pattern of security weaknesses that have required patching. Despite the current static analysis not revealing critical vulnerabilities, the historical pattern and the unprotected attack surface warrant caution.