Relevanssi CVE-2026-116522

Exploitation requires a specific non-default configuration: the site must have BOTH Relevanssi comment indexing AND comment highlighting enabled (the vendor fix in 4.28.6 simply removes comment-text highlighting entirely). An unauthenticated attacker injects the payload by posting a comment, but execution is gated: the payload fires ONLY when a visitor reaches a singular page via a Relevanssi search-result permalink that carries the highlight query parameter. Limiting factors that reduce realistic risk: the dual-option configuration is not enabled by default, and successful triggering depends on getting a victim to follow the crafted highlight permalink rather than firing on any ordinary page view.

The input provides a vendor CVSS of 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, PR:N = unauthenticated), a Wordfence/vuln.today decision label of 'this_week' (not act_now or emergency), and CWE-79 stored XSS. No EPSS score, no CISA KEV entry, and no working exploit are present in the data, so there is no public exploit identified at time of analysis - only a Wordfence advisory and source/patch references. The single most important risk-reducing signal is in the description itself: exploitation requires BOTH the comment indexing and comment highlighting options to be enabled (a non-default combination), and the payload only fires when a visitor reaches a singular page through a Relevanssi search-result permalink carrying the highlight query parameter. That means the vendor's UI:N is questionable - luring a victim to a specific crafted permalink is user interaction, so real-world triggering is closer to UI:R than the base vector suggests. Net: this is a genuine but conditional stored XSS, not a high-CVSS-but-trivially-exploitable crisis; the 7.2 is driven partly by S:C (scope change) and PR:N, while the layered configuration and permalink prerequisites make widespread opportunistic exploitation unlikely. The 'this_week' label is consistent with prompt patching rather than emergency response. EPSS and KEV data are simply absent (not an error); their absence should not be read as either elevated or reduced risk.

On a site that has enabled both Relevanssi comment indexing and comment highlighting, an unauthenticated attacker posts a comment containing a script payload, which Relevanssi indexes. The attacker then lures a victim to click a crafted Relevanssi search-result permalink pointing at the singular page and carrying the highlight query parameter, at which point the unsanitized comment text is reflected into the highlighted output and the script executes in the victim's browser. No public exploit code is identified in the provided data; the only published artifacts are the Wordfence advisory and the vendor patch.