Relevanssi Premium CVE-2026-103426

Exploitation requires the plugin's 'click-tracking and logging' feature to be explicitly activated in Relevanssi Premium settings - a non-default configuration; sites without this feature enabled are not exploitable. When enabled, no authentication is needed (PR:N) because a valid _rt_nonce is publicly emitted on every search-results page, so the nonce provides no real barrier to unauthenticated attackers. Realistic impact is further gated by the stored-XSS delivery model: the payload only executes when a user subsequently accesses the injected page. Affected scope is Relevanssi Premium versions 0 through 2.31.4 inclusive; the free Relevanssi edition and sites on later/patched versions are outside the stated affected range.

This is a credible, moderately-high priority issue rather than a mere paper tiger, though it falls short of emergency status. The Wordfence-supplied CVSS vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2) indicates network-reachable, low-complexity, unauthenticated exploitation with a scope change (script executing in the victim's browser context), and the description reinforces low complexity by noting a valid _rt_nonce is publicly emitted on every search-results page - defeating the one control that would otherwise gate the click-tracking endpoint. No EPSS score, KEV listing, or POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk is therefore potential rather than demonstrated. The single most important mitigating signal is NOT in the CVSS vector: exploitation requires the non-default 'click-tracking and logging' feature to be enabled, which sharply narrows the realistically vulnerable population. The CVSS impact is also only Low/Low (stored XSS, no availability impact). Net: treat as a real, patch-worthy stored XSS for sites running Relevanssi Premium with click-tracking enabled, but the conditional feature requirement and absence of exploitation evidence argue against treating it as a drop-everything incident.

On a WordPress site running Relevanssi Premium (≤2.31.4) with click-tracking and logging enabled, an unauthenticated attacker harvests the publicly-emitted _rt_nonce from a normal search-results page, then submits a crafted '_rt' parameter containing a malicious script payload. The payload is stored and later executes in the browser of any user who accesses the injected page, enabling session/cookie theft or actions in the victim's context. No public exploit was identified in the provided data, but the attack is trivially accessible given the nonce exposure and low complexity.