Relevanssi WordPress plugin: Stored Cross-Site Scripting (CVE-2026-116522)
The Relevanssi - A Better Search plugin for WordPress (v4.28.5 and earlier) is vulnerable to stored cross-site scripting (XSS) via the comment parameter, allowing unauthenticated attackers to execute arbitrary scripts when specific search-highlighting features are enabled.
CVE search metadata
CVE search record: CVE-2026-116522. Severity: high. CVSS: 7.2. KEV: no. Product: Relevanssi – A Better Search (<= 4.28.5). Brief: Relevanssi WordPress plugin: Stored Cross-Site Scripting (CVE-2026-116522). Brief link: https://feed.craftedsignal.io/briefs/2026-10-relevanssi-xss-a6ce5e25/
Triage facts
Revision 1- Applicability
- Relevanssi – A Better Search (<= 4.28.5)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 31, 07:52 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
The Relevanssi - A Better Search plugin for WordPress contains a stored cross-site scripting vulnerability caused by insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts via the 'comment' parameter. The vulnerability only triggers when the target WordPress site has both 'comment indexing' and 'comment highlighting' options enabled, and a user visits a singular page via a search-result permalink that includes the highlight query parameter.
Impact
Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of a user's browser session.
Recommendation
- Update the Relevanssi - A Better Search plugin to version 4.28.6 or higher, once available.
- Disable the 'comment indexing' and 'comment highlighting' features in the Relevanssi plugin settings as a temporary mitigation if patching is not immediately feasible.
- Audit existing comment content for suspicious script tags or obfuscated JavaScript.
Immediate actions
Check Relevanssi plugin version and verify if comment indexing/highlighting features are active
Threat Hunt
Inspect WordPress database or server access logs for anomalous comment content containing script tags or JavaScript events
Data: Database comment tables, Web server access logs
Mitigations
Disable comment indexing and highlighting in Relevanssi settings
CVE-2026-116522