Relevanssi A Better Search
Monthly
Reflected XSS in Relevanssi - A Better Search (≤4.28.1) allows unauthenticated remote attackers to inject arbitrary JavaScript into WordPress search pages when a site administrator has enabled the plugin's 'Debugging mode' setting. The vulnerability exists in `relevanssi_debug_array()` (lib/debug.php), which passes raw user-supplied query parameters `s`, `post_types`, and `orderby` through PHP's `print_r()` into an unescaped `<pre>` HTML block. The debug code path is activated by appending `relevanssi_debug=on` to any search request and intentionally bypasses nonce, capability, and login checks - making it reachable by any unauthenticated visitor whenever debugging is active. Exploitation still requires user interaction (UI:R) to deliver the reflected payload, and no public exploit or KEV listing has been identified at time of analysis.
SQL injection in Relevanssi's Admin Search AJAX handler (both free and Premium editions) allows authenticated WordPress contributors to perform time-based blind SQL injection against the site's database, exposing all stored data including user password hashes and private content. The taxonomy query argument passed through the `args` parameter is sanitized against XSS but never parameterized before SQL interpolation, violating the principle that sanitization and parameterization are distinct concerns. No public exploit has been identified at time of analysis, but the low privilege bar - contributor-level access, attainable on any site with open registration - meaningfully widens the realistic attack surface beyond what the 6.5 CVSS score alone conveys.
Reflected XSS in Relevanssi - A Better Search (≤4.28.1) allows unauthenticated remote attackers to inject arbitrary JavaScript into WordPress search pages when a site administrator has enabled the plugin's 'Debugging mode' setting. The vulnerability exists in `relevanssi_debug_array()` (lib/debug.php), which passes raw user-supplied query parameters `s`, `post_types`, and `orderby` through PHP's `print_r()` into an unescaped `<pre>` HTML block. The debug code path is activated by appending `relevanssi_debug=on` to any search request and intentionally bypasses nonce, capability, and login checks - making it reachable by any unauthenticated visitor whenever debugging is active. Exploitation still requires user interaction (UI:R) to deliver the reflected payload, and no public exploit or KEV listing has been identified at time of analysis.
SQL injection in Relevanssi's Admin Search AJAX handler (both free and Premium editions) allows authenticated WordPress contributors to perform time-based blind SQL injection against the site's database, exposing all stored data including user password hashes and private content. The taxonomy query argument passed through the `args` parameter is sanitized against XSS but never parameterized before SQL interpolation, violating the principle that sanitization and parameterization are distinct concerns. No public exploit has been identified at time of analysis, but the low privilege bar - contributor-level access, attainable on any site with open registration - meaningfully widens the realistic attack surface beyond what the 6.5 CVSS score alone conveys.