CVE-2026-103426 in Premium Plugin
Summary
by MITRE • 10/02/2026
The Relevanssi Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_rt' parameter in all versions up to, and including, 2.31.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the click-tracking and logging feature to be activated in the plugin settings, and exploitation is trivially accessible to unauthenticated users because a valid _rt_nonce is publicly emitted on every search-results page.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The Relevanssi Premium WordPress plugin contains a critical security flaw affecting all versions up to 2.31.4, characterized by insufficient input sanitization and output escaping mechanisms within the '_rt' parameter handling logic. This vulnerability allows for Stored Cross-Site Scripting attacks, where malicious scripts are permanently stored on the target server rather than being executed immediately upon request injection. The root cause lies in the failure to properly validate or encode user-supplied data before it is processed by the plugin's internal functions, creating a direct pathway for attackers to inject executable JavaScript code into the application environment.
The operational impact of this vulnerability is significant because it enables unauthenticated attackers to compromise the integrity and security of WordPress sites running the affected software. Since the injection point relies on the click-tracking and logging feature being active in the plugin settings, exploitation requires a specific configuration state but remains highly accessible due to the public availability of valid nonces. The '_rt_nonce' value is emitted publicly on every search-results page, effectively removing any authentication barrier that might otherwise protect against such attacks. This means that any visitor with basic web browsing capabilities can craft and submit malicious payloads without needing prior access credentials or elevated privileges within the WordPress ecosystem.
From a technical perspective, this vulnerability aligns closely with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The stored nature of the attack means that the injected script persists in the database and is served to every user who views the compromised page or search result. This transforms a simple injection into a persistent threat vector capable of affecting multiple victims over an extended period. Furthermore, the ease of obtaining the required nonce through public pages exemplifies CWE-347 Improper Verification of Cryptographic Signature, as the system fails to ensure that nonces are kept secret and used only for intended authenticated operations rather than being exposed in a manner that facilitates unauthorized actions.
The exploitation chain is straightforward: an attacker identifies a WordPress site using Relevanssi Premium with click-tracking enabled, retrieves the public '_rt_nonce' from any search results page, and submits a crafted request containing malicious JavaScript within the '_rt' parameter. Once stored by the application, this payload executes in the context of legitimate users who access the affected pages. This can lead to session hijacking, credential theft via keyloggers, defacement of the website content, or redirection to phishing sites designed to harvest sensitive information from unsuspecting visitors. The lack of proper output escaping ensures that browsers interpret the injected code as executable script rather than plain text data.
Mitigation strategies must focus on immediate remediation and enhanced security practices. Administrators should update the Relevanssi Premium plugin to version 2.31.5 or later, where these input validation and output encoding issues have been addressed by the developers. In cases where updating is not immediately feasible, disabling the click-tracking and logging feature can temporarily mitigate the risk by removing the specific code path exploited in this vulnerability. Additionally, implementing a Web Application Firewall with rulesets tuned to detect and block common XSS payloads can provide an additional layer of defense against exploitation attempts while patches are being deployed. Regular security audits and adherence to secure coding standards that mandate strict input sanitization and output escaping for all dynamic content will help prevent similar vulnerabilities in future software updates or custom implementations.