CVE-2026-97641 in Relevanssi Plugin
Summary
by MITRE • 10/02/2026
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 4.28.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the administrator has configured a non-empty value for the "Allowable tags in excerpts" setting, such as the default example value of <p><a><strong>, as the prefix-matching regex must have an allowable tag whose name is a prefix of the injected tag name.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/02/2026
The Relevanssi plugin, widely utilized within the WordPress ecosystem to enhance search functionality by providing more accurate and relevant results than the default core implementation, contains a critical security flaw in versions up through 4.28.3. This vulnerability manifests as a Stored Cross-Site Scripting issue located specifically within the handling of comment content. The root cause lies in insufficient input sanitization and inadequate output escaping mechanisms embedded within the plugin's codebase. When users submit comments, the application fails to properly validate or encode special characters that could be interpreted as executable script tags by web browsers. This deficiency allows malicious actors to inject arbitrary JavaScript payloads directly into the database via comment fields, which are then rendered on public-facing pages without proper sanitization.
The operational impact of this vulnerability is significant because it enables unauthenticated attackers to execute code in the context of any user who views a page containing the injected content. Unlike reflected XSS attacks that require social engineering to trick users into clicking malicious links, stored vulnerabilities persist until manually removed from the database. Consequently, every visitor to an affected site becomes a potential victim when their browser parses and executes the embedded script. This can lead to severe consequences including session hijacking, where attackers steal authentication cookies to impersonate legitimate users; defacement of website content; or redirection to malicious sites designed for phishing or malware distribution. The persistence of this payload makes it particularly dangerous as it affects multiple victims over an extended period without further action from the attacker.
Exploitation of this specific vulnerability is contingent upon a particular configuration state within the WordPress installation using Relevanssi. Specifically, the attack requires that the administrator has configured a non-empty value for the Allowable tags in excerpts setting. The plugin employs a prefix-matching regular expression to determine which HTML tags are permitted during excerpt generation. If an allowable tag exists whose name is a strict prefix of the injected malicious tag name, the filter fails to block it. For instance, if common safe tags like paragraph or anchor tags are allowed, attackers can craft payloads using tags such as script that might bypass certain naive filtering logic depending on how the regex engine processes the input string relative to the allowlist. This dependency means that while many installations may be vulnerable by default due to standard configurations, administrators who have explicitly disabled all allowable tags in excerpts would theoretically mitigate this specific vector.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The stored nature of the attack also correlates with MITRE ATT&CK technique T1059, specifically sub-technique 007 for JavaScript execution. Furthermore, it relates to CWE-20 regarding improper input validation and CWE-80 for missing output encoding. These classifications highlight that the failure is not merely in accepting bad data but also in failing to neutralize dangerous characters before rendering them to end-users. The combination of these weaknesses creates a scenario where user-supplied content becomes an active execution environment rather than static text, violating the principle of least privilege and secure default configurations expected in modern web applications.
Mitigation strategies must address both immediate remediation and long-term security hygiene. Administrators should immediately update the Relevanssi plugin to version 4.28.4 or later where these sanitization issues have been resolved by developers through rigorous input validation and robust output encoding practices. For those unable to patch instantly, reviewing the Allowable tags in excerpts setting is crucial; disabling this feature entirely removes the specific prefix-matching bypass vector described above. Additionally implementing a Web Application Firewall can provide an additional layer of defense by detecting and blocking common XSS payloads before they reach the application logic. Long-term improvements involve adopting Content Security Policy headers to restrict script execution sources, thereby limiting the damage even if a successful injection occurs. Regular security audits and code reviews focusing on data flow from user input to browser output are essential to prevent similar vulnerabilities in future updates or other plugins within the WordPress environment.