Relevanssi EUVD-2026-91244

Exploitation requires a specific non-default admin configuration: the 'Allowable tags in excerpts' setting must hold a non-empty value (e.g. the documented example <p><a><strong>), AND comment content must be indexed and displayed in Relevanssi excerpts (relevanssi_index_comments enabled). The injected tag only bypasses sanitization when its name is prefixed by an allowed tag name (the prefix-matching regex flaw - allowed <a> permits injected <audio>, allowed <p> permits <picture>, etc.); if the allowable-tags setting is empty, exploitation is not possible. Attacker-side requires only the ability to submit a comment (unauthenticated, PR:N), but the victim must subsequently view a search results/excerpt page that renders the injected comment. These limiting factors - dependence on operator configuration and the prefix-tag constraint - meaningfully narrow realistic exploitability below what the raw CVSS score implies.

This is a stored XSS (CWE-79) in the Relevanssi WordPress search plugin, rated CVSS 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) by the reporting source Wordfence. The headline-elevating factors are the network vector, no-privilege (PR:N, unauthenticated) injection point, and the changed scope (S:C) reflecting script execution in victims' browser context. However, the real-world risk is substantially gated by non-default preconditions that the CVSS AC:L metric understates: per the description, exploitation ONLY works when the administrator has set a non-empty 'Allowable tags in excerpts' value AND comment content is indexed/shown in excerpts, with success further depending on a quirk where an allowed tag name is a prefix of the injected tag (e.g. allowed <a> enabling injected <audio>). There is NO EPSS score, NO CISA KEV listing, and NO public POC provided, so exploitation status is 'no public exploit identified at time of analysis' - this is a vendor/researcher-disclosed, already-patched flaw rather than an actively exploited one. Net: a legitimate stored-XSS issue worth patching on affected sites, but not an emergency-priority, mass-exploitable bug - the configuration dependency and prefix-matching requirement make it closer to a conditional, moderate-risk issue than the 7.2 'High' score suggests in isolation.

On a site running Relevanssi ≤4.28.3 where the admin has configured a non-empty 'Allowable tags in excerpts' value (e.g. the example <p><a><strong>) and comment indexing is enabled, an unauthenticated attacker posts a comment containing a crafted tag whose name shares a prefix with an allowed tag (such as <audio ... onerror=...> slipping past the <a> allowance). When the comment content is surfaced in a Relevanssi search excerpt, the sanitization regex fails to strip the tag and the script executes in the browser of any user who views the injected search result page. No public exploit code was identified at time of analysis.