Relevanssi Premium
Monthly
Stored cross-site scripting in Relevanssi Premium through 2.31.4 lets unauthenticated attackers inject arbitrary web scripts through the '_rt' parameter when the plugin's click-tracking and logging feature is enabled. A valid _rt_nonce is publicly emitted on every search-results page, so the nonce does not stop unauthenticated exploitation, and the payload executes when a user later visits the injected page. No public exploit identified at time of analysis; exploitation requires the non-default click-tracking feature and is therefore not applicable to default-configuration sites.
Stored cross-site scripting in Relevanssi Premium through 2.31.4 lets unauthenticated attackers inject arbitrary web scripts through the '_rt' parameter when the plugin's click-tracking and logging feature is enabled. A valid _rt_nonce is publicly emitted on every search-results page, so the nonce does not stop unauthenticated exploitation, and the payload executes when a user later visits the injected page. No public exploit identified at time of analysis; exploitation requires the non-default click-tracking feature and is therefore not applicable to default-configuration sites.