CVE-2026-116522 in Relevanssi Plugin
Summary
by MITRE • 10/31/2026
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.28.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the site to have both the comment indexing and comment highlighting options enabled, and the payload only fires when a visitor reaches a singular page via a Relevanssi search-result permalink carrying the highlight query parameter.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 11/01/2026
The vulnerability identified in the Relevanssi plugin for WordPress represents a significant security risk due to its potential for Stored Cross-Site Scripting attacks. This flaw exists within all versions of the plugin up through 4.28.5 and stems from insufficient input sanitization and output escaping mechanisms when handling user-supplied data. Specifically, the vulnerability is triggered via the comment parameter, which allows unauthenticated attackers to inject arbitrary web scripts into pages that are subsequently executed whenever a legitimate user accesses an affected page containing the injected content.
The operational impact of this vulnerability is substantial because it enables persistent malicious code execution on targeted websites without requiring any form of authentication from the attacker. For exploitation to occur successfully, specific conditions must be met within the WordPress site configuration: both comment indexing and comment highlighting options need to be enabled by the administrator. Furthermore, the payload only executes under precise circumstances where a visitor reaches a singular page through a Relevanssi search-result permalink that carries the highlight query parameter. This specificity means that while not every instance of the plugin is immediately exploitable in all configurations, those with these features active are at high risk.
From a technical perspective, this vulnerability aligns closely with Common Weakness Enumeration (CWE) categories such as CWE-79: Improper Neutralization of Input During Web Page Generation Cross-site Scripting and CWE-601: URL Redirection to Untrusted Site Open Redirect if applicable in related contexts involving redirection logic. The lack of proper sanitization allows malicious scripts to be stored within the database via comments, which are then rendered unsafely on frontend pages when specific search parameters trigger their display. This persistence mechanism distinguishes it from reflected XSS attacks and increases its severity as each page view by a victim can result in script execution without further interaction or manipulation of URLs beyond normal browsing behavior facilitated by the plugin's functionality.
In terms of attack vector classification, this scenario corresponds to MITRE ATT&CK techniques related to Client-side Injection, particularly those involving stored payloads that persist across sessions and user interactions. Attackers could leverage this vulnerability for various malicious purposes including session hijacking through cookie theft, defacement of website content, phishing attacks by injecting deceptive login forms or messages, or even deploying additional malware onto visitors' devices via drive-by downloads if combined with other exploits targeting browser vulnerabilities.
Mitigation strategies should prioritize immediate updates to the latest patched version of Relevanssi once available from official repositories. Administrators currently unable to update immediately may consider disabling comment indexing and highlighting features temporarily until patches are applied, thereby removing the conditions necessary for exploitation. Additionally implementing Web Application Firewall rules that detect and block common XSS payloads in HTTP requests can provide an additional layer of defense against such injection attempts. Regular security audits focusing on input validation practices across all plugins used within WordPress environments will help prevent similar vulnerabilities from being introduced or remaining undetected over time.