Relevanssi A Better Search
Monthly
Stored cross-site scripting in the Relevanssi - A Better Search WordPress plugin, affecting every version up to and including 4.28.5, lets unauthenticated attackers submit a comment whose body is later rendered with Relevanssi's highlight markup and without adequate sanitization or escaping. Execution is tightly gated: the site must have both comment indexing and comment highlighting enabled, and the injected script only fires when a victim follows a crafted search-result permalink containing the highlight query parameter to a singular page - a user-interaction step reflected in the assessed vector (UI:R), which is why our assessment scores it slightly differently from the vendor's 7.2 (UI:N). No public exploit code has been identified at time of analysis, no KEV listing applies, and the issue is prioritised 'this_week' rather than as an emergency; version 4.28.6 resolves it by removing comment-text highlighting altogether.
Stored cross-site scripting in the Relevanssi - A Better Search WordPress plugin through 4.28.3 lets unauthenticated attackers submit comment content that is later rendered as executable markup in search-result excerpts, so scripts run in the browser of any visitor or administrator who views an affected excerpt page. Exploitation is conditional rather than universal: the site's 'Allowable tags in excerpts' option must be non-empty (for example the documented default example of <p><a><strong>), comment content must be indexed and displayed (relevanssi_index_comments enabled), and the injected tag name must be prefixed by an allowed tag name - allowed <a> permits injected <audio>, allowed <p> permits <picture> - because of a prefix-matching regex flaw that fails to require complete tag names. Wordfence rates this 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), while this assessment applies AC:H in recognition of the operator-configuration dependency; no public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation.
Reflected XSS in Relevanssi - A Better Search (≤4.28.1) allows unauthenticated remote attackers to inject arbitrary JavaScript into WordPress search pages when a site administrator has enabled the plugin's 'Debugging mode' setting. The vulnerability exists in `relevanssi_debug_array()` (lib/debug.php), which passes raw user-supplied query parameters `s`, `post_types`, and `orderby` through PHP's `print_r()` into an unescaped `<pre>` HTML block. The debug code path is activated by appending `relevanssi_debug=on` to any search request and intentionally bypasses nonce, capability, and login checks - making it reachable by any unauthenticated visitor whenever debugging is active. Exploitation still requires user interaction (UI:R) to deliver the reflected payload, and no public exploit or KEV listing has been identified at time of analysis.
SQL injection in Relevanssi's Admin Search AJAX handler (both free and Premium editions) allows authenticated WordPress contributors to perform time-based blind SQL injection against the site's database, exposing all stored data including user password hashes and private content. The taxonomy query argument passed through the `args` parameter is sanitized against XSS but never parameterized before SQL interpolation, violating the principle that sanitization and parameterization are distinct concerns. No public exploit has been identified at time of analysis, but the low privilege bar - contributor-level access, attainable on any site with open registration - meaningfully widens the realistic attack surface beyond what the 6.5 CVSS score alone conveys.
Stored cross-site scripting in the Relevanssi - A Better Search WordPress plugin, affecting every version up to and including 4.28.5, lets unauthenticated attackers submit a comment whose body is later rendered with Relevanssi's highlight markup and without adequate sanitization or escaping. Execution is tightly gated: the site must have both comment indexing and comment highlighting enabled, and the injected script only fires when a victim follows a crafted search-result permalink containing the highlight query parameter to a singular page - a user-interaction step reflected in the assessed vector (UI:R), which is why our assessment scores it slightly differently from the vendor's 7.2 (UI:N). No public exploit code has been identified at time of analysis, no KEV listing applies, and the issue is prioritised 'this_week' rather than as an emergency; version 4.28.6 resolves it by removing comment-text highlighting altogether.
Stored cross-site scripting in the Relevanssi - A Better Search WordPress plugin through 4.28.3 lets unauthenticated attackers submit comment content that is later rendered as executable markup in search-result excerpts, so scripts run in the browser of any visitor or administrator who views an affected excerpt page. Exploitation is conditional rather than universal: the site's 'Allowable tags in excerpts' option must be non-empty (for example the documented default example of <p><a><strong>), comment content must be indexed and displayed (relevanssi_index_comments enabled), and the injected tag name must be prefixed by an allowed tag name - allowed <a> permits injected <audio>, allowed <p> permits <picture> - because of a prefix-matching regex flaw that fails to require complete tag names. Wordfence rates this 7.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), while this assessment applies AC:H in recognition of the operator-configuration dependency; no public exploit code has been identified at time of analysis and there is no evidence of confirmed active exploitation.
Reflected XSS in Relevanssi - A Better Search (≤4.28.1) allows unauthenticated remote attackers to inject arbitrary JavaScript into WordPress search pages when a site administrator has enabled the plugin's 'Debugging mode' setting. The vulnerability exists in `relevanssi_debug_array()` (lib/debug.php), which passes raw user-supplied query parameters `s`, `post_types`, and `orderby` through PHP's `print_r()` into an unescaped `<pre>` HTML block. The debug code path is activated by appending `relevanssi_debug=on` to any search request and intentionally bypasses nonce, capability, and login checks - making it reachable by any unauthenticated visitor whenever debugging is active. Exploitation still requires user interaction (UI:R) to deliver the reflected payload, and no public exploit or KEV listing has been identified at time of analysis.
SQL injection in Relevanssi's Admin Search AJAX handler (both free and Premium editions) allows authenticated WordPress contributors to perform time-based blind SQL injection against the site's database, exposing all stored data including user password hashes and private content. The taxonomy query argument passed through the `args` parameter is sanitized against XSS but never parameterized before SQL interpolation, violating the principle that sanitization and parameterization are distinct concerns. No public exploit has been identified at time of analysis, but the low privilege bar - contributor-level access, attainable on any site with open registration - meaningfully widens the realistic attack surface beyond what the 6.5 CVSS score alone conveys.