CVE-2021-24234

The Ivory Search plugin before version 4.6.1 contains a reflected cross-site scripting vulnerability in the Search Forms page where the tab parameter is inadequately sanitized before being displayed. An attacker could exploit this flaw by crafting a malicious link that, when clicked by an administrator or other high-privilege user, would execute arbitrary JavaScript in their browser. The attack requires knowledge of a specific form identifier to be successful.

Based on public CVE data (MITRE/NVD).