PLUGIN SECURITY
Is Add Search To Menu safe?
Advanced WordPress custom search plugin. Provides Search Form Customizer, WooCommerce Search, AJAX Search & Live Search support!
What this plugin does
- Slug:
add-search-to-menu - Author: Vinod Dalvi
- 100000+ active installs
- 98/100 rating (1560 reviews on wordpress.org)
- 3069966 all-time downloads
- On WordPress.org since 2017-04-06
ajax searchfile searchimage searchsearchwoocommerce search
Maintenance status
- Latest known version: 5.5.16
- Last updated: 2026-08-24 10:43am GMT
- Tested up to WordPress: 7.1
- Requires PHP: 5.2.4+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
11 known CVEs on file for Add Search To Menu.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-11356 | Ivory Search – WordPress Search Plugin [add-search-to-menu] < 5.5.16 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.4 | < 5.5.16 | 5.5.16 | 2026-06-26 | ✓ fixed in latest |
| CVE-2024-13362 | Ivory Search – WordPress Search Plugin [add-search-to-menu] < 5.5.9 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 5.5.9 | 5.5.9 | 2026-04-30 | ✓ fixed in latest |
| CVE-2025-63069 | Ivory Search – WordPress Search Plugin [add-search-to-menu] < 5.5.13 | Missing Authorization | Medium 5.3 | < 5.5.13 | 5.5.13 | 2025-09-28 | ✓ fixed in latest |
| CVE-2024-6835 | Ivory Search – WordPress Search Plugin [add-search-to-menu] < 5.5.7 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 5.3 | < 5.5.7 | 5.5.7 | 2024-09-04 | ✓ fixed in latest |
| CVE-2024-3233 | Ivory Search – WordPress Search Plugin [add-search-to-menu] < 5.5.6 | Missing Authorization | Medium 4.3 | < 5.5.6 | 5.5.6 | 2024-04-12 | ✓ fixed in latest |
| CVE-2023-33999 | Ivory Search – WordPress Search Plugin [add-search-to-menu] < 5.5.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | High 7.1 | < 5.5.2 | 5.5.2 | 2023-07-18 | ✓ fixed in latest |
| — | Ivory Search – WordPress Search Plugin [add-search-to-menu] < 5.4.7 | — | Unknown | < 5.4.7 | 5.4.7 | 2022-07-04 | ✓ fixed in latest |
| — | Ivory Search – WordPress Search Plugin [add-search-to-menu] < 5.4.7 | — | Unknown | < 5.4.7 | 5.4.7 | 2022-07-04 | ✓ fixed in latest |
+ 21 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| — | Ivory Search – WordPress Search Plugin [add-search-to-menu] < 5.4.4 | Missing Authorization | Medium 6.3 | < 5.4.4 | 5.4.4 | 2022-03-04 | ✓ fixed in latest |
| — | Ivory Search – WordPress Search Plugin [add-search-to-menu] < 5.4.4 | — | Unknown | < 5.4.4 | 5.4.4 | 2022-02-28 | ✓ fixed in latest |
| — | Ivory Search – WordPress Search Plugin [add-search-to-menu] < 5.4.4 | — | Unknown | < 5.4.4 | 5.4.4 | 2022-02-28 | ✓ fixed in latest |
| CVE-2021-25105 | Ivory Search – WordPress Search Plugin [add-search-to-menu] < 5.4.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 5.4.4 | 5.4.4 | 2022-01-10 | ✓ fixed in latest |
| — | Ivory Search – WordPress Search Plugin [add-search-to-menu] < 4.7.1 | — | Unknown | < 4.7.1 | 4.7.1 | 2021-11-02 | ✓ fixed in latest |
| — | Ivory Search – WordPress Search Plugin [add-search-to-menu] < 4.8 | — | Unknown | < 4.8 | 4.8 | 2021-11-02 | ✓ fixed in latest |
| CVE-2021-36869 | Ivory Search – WordPress Search Plugin [add-search-to-menu] < 5.4.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 5.4.4 | 5.4.4 | 2021-10-01 | ✓ fixed in latest |
| CVE-2021-24234 | Ivory Search – WordPress Search Plugin [add-search-to-menu] < 4.6.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 4.6.1 | 4.6.1 | 2021-03-30 | ✓ fixed in latest |
| — | Ivory Search – WordPress Search Plugin [add-search-to-menu] < 4.5.11 | — | Unknown | < 4.5.11 | 4.5.11 | 2021-02-01 | ✓ fixed in latest |
| — | Ivory Search – WordPress Search Plugin [add-search-to-menu] < 4.5.11 | — | Unknown | < 4.5.11 | 4.5.11 | 2021-02-01 | ✓ fixed in latest |
| — | Ivory Search – WordPress Search Plugin [add-search-to-menu] < 5.5.10 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 5.5.10 | 5.5.10 | 0000-00-00 | ✓ fixed in latest |
| — | Ivory Search – WordPress Search Plugin [add-search-to-menu] < 5.5.14 | — | Unknown | < 5.5.14 | 5.5.14 | 0000-00-00 | ✓ fixed in latest |
| — | Ivory Search – WordPress Search Plugin [add-search-to-menu] < 5.4.7 | — | Unknown | < 5.4.7 | 5.4.7 | — | ✓ fixed in latest |
| — | Ivory Search – WordPress Search Plugin [add-search-to-menu] < 4.8 | — | Unknown | < 4.8 | 4.8 | — | ✓ fixed in latest |
| — | Ivory Search – WordPress Search Plugin [add-search-to-menu] < 4.5.11 | — | Unknown | < 4.5.11 | 4.5.11 | — | ✓ fixed in latest |
| — | Ivory Search < 4.5.11 - Authenticated Reflected Cross-Site Scripting (XSS) | — | Unknown | < 4.5.11 | 4.5.11 | — | ✓ fixed in latest |
| — | Ivory Search < 4.8 - Contributor+ Stored Cross-Site Scripting | — | Unknown | < 4.8 | 4.8 | — | ✓ fixed in latest |
| — | Unauthorised AJAX Calls via Freemius | — | Unknown | < 5.4.4 | 5.4.4 | — | ✓ fixed in latest |
| — | Ivory Search < 5.4.7 - Reflected Cross-Site Scripting | — | Unknown | < 5.4.7 | 5.4.7 | — | ✓ fixed in latest |
| CVE-2025-5209 | Ivory Search < 5.5.10 - Admin+ Stored XSS | — | Unknown | < 5.5.10 | 5.5.10 | — | ✓ fixed in latest |
| CVE-2026-1053 | Ivory Search < 5.5.14 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'menu_gcse' and 'nothing_found_text' Parameters | — | Unknown | < 5.5.14 | 5.5.14 | — | ✓ fixed in latest |
How to fix it
Keep Add Search To Menu updated — 5.5.16 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- FiboSearch – Ajax Search for WooCommerce — 100000+ active installs — 98/100 (1814) — max PHP 8.4
- Advance Product Search- Voice & Ajax Search for WooCommerce — 9000+ active installs — 100/100 (5) — max PHP 8.4
- Sokol: Smart WooCommerce Search — 6000+ active installs — 88/100 (24) — max PHP 8.4
- Jetpack Search — 5000+ active installs — 90/100 (10)
- Advanced Product Search For WooCommerce — 4000+ active installs — 86/100 (6)
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.