EUVD-2026-75937
GHSA-342h-68mm-3pfr
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify site running Relevanssi with debugging enabled
-
DeliveryCraft URL with XSS payload in `s`/`post_types`/`orderby` + `relevanssi_debug=on`
-
ExploitDeliver link to authenticated admin via phishing
-
ExecutionAdmin visits URL, debug path bypasses auth/nonce checks
-
PersistBrowser executes injected script in admin session
-
ImpactExfiltrate session cookie or perform admin-level actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that a WordPress site administrator has previously navigated to the Relevanssi settings panel and enabled the 'Debugging mode' option, which is off by default. When that setting is active, any HTTP request appending |
| Impact | The published CVSS 6.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) reflects a standard reflected-XSS baseline, but AC:L overstates the ease of exploitation: the attack is gated behind a non-default administrator setting ('Debugging mode'), which is off by default and typically used only during site troubleshooting. In practice, the realistic attack surface is limited to WordPress deployments where an admin has actively enabled and forgotten to disable this mode. EPSS data is not included in the provided intelligence, and there is no KEV listing and no known POC at time of analysis. The scope-change (S:C) and UI:R are both accurate - the reflected payload executes in the victim's browser context, potentially allowing session-cookie theft or admin-account compromise if an admin is tricked into clicking a crafted link while logged in. The real-world risk is moderate-to-low for sites without debugging active, but elevated for any WordPress installation where the setting is currently enabled. |
| Exploit ScenarioDerived | An attacker identifies a WordPress site running Relevanssi ≤4.28.1 with 'Debugging mode' active, then crafts a search URL such as |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 11, 2026
Reflected XSS in Relevanssi - A Better Search (≤4.28.1) allows unauthenticated remote attackers to inject arbitrary JavaScript into WordPress search pages when a site administrator has enabled the plugin's 'Debugging mode' setting. The vulnerability exists in relevanssi_debug_array() (lib/debug.php), which passes raw user-supplied query parameters s, post_types, and orderby through PHP's print_r() into an unescaped <pre> HTML block. The debug code path is activated by appending relevanssi_debug=on to any search request and intentionally bypasses nonce, capability, and login checks - making it reachable by any unauthenticated visitor whenever debugging is active. Exploitation still requires user interaction (UI:R) to deliver the reflected payload, and no public exploit or KEV listing has been identified at time of analysis.
RemediationAI
The upstream fix is captured in WordPress Plugin Trac changeset moving from revision 3529670 to 3650355 on the relevanssi trunk; site operators should upgrade to the first tagged release following 4.28.1 once published - the exact fix-version number is not independently confirmed in the available data, so monitor the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/d07fe28c-f76e-42b2-b894-be316004235a for the confirmed patched version. As an immediate compensating control, administrators should disable the plugin's 'Debugging mode' setting in the Relevanssi configuration panel - this directly removes the code path that exposes the vulnerability with no functional impact on search. Blocking the relevanssi_debug query parameter at the WAF or web server layer is a secondary mitigation with minimal side effects. Do not leave debugging mode enabled in production environments.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Relevanssi is a PHP-based WordPress search replacement plugin identified by CPE cpe:2.3:a:comesio:relevanssi_-_a_better_search. The flaw is a CWE-79 (Improper Neutralization of Input During Web Page Generation) reflected XSS rooted in lib/debug.php around line 68 and search.php lines 132, 143, and 562. When the administrator enables 'Debugging mode', a plugin-level flag allows any HTTP request carrying relevanssi_debug=on to trigger relevanssi_debug_array(). That function calls PHP's print_r() on the raw $_GET/$_REQUEST query-variable array - including s (search term), post_types, and orderby - and emits the result directly inside an HTML <pre> block with no htmlspecialchars() or esc_html() escaping. The vendor explicitly suppresses nonce verification on that code path (evidenced by a comment in the source), removing the standard WordPress CSRF/auth gate. The Trac changeset diff (old revision 3529670 → new 3650355) represents the upstream fix.
Know when PHP gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
AC:H reflects non-default 'Debugging mode' prerequisite beyond attacker control; all other metrics match standard reflected XSS with scope change.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Relevanssi - A Better Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.28.1 via the 's', 'post_types', and 'orderby' request parameters. This is due to insufficient input sanitization and output escaping in the relevanssi_debug_array() function in lib/debug.php, which dumps user-supplied query variables through print_r() inside a <pre> block without HTML escaping. The debug path is enabled by supplying the relevanssi_debug=on request parameter when the administrator has previously enabled the 'Debugging mode' setting; the gate itself is a configuration check with no capability, nonce, or logged-in check (the vendor explicitly suppresses nonce verification on that line). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Exploit-DB