{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3arelevanssipremium/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:relevanssi:premium:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-103426"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Relevanssi Premium (\u003c= 2.31.4)"],"_cs_severities":["high"],"_cs_tags":["web-application","xss"],"_cs_type":"advisory","_cs_vendors":["Relevanssi"],"content_html":"\u003cp\u003eThe Relevanssi Premium plugin for WordPress is susceptible to a stored Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-103426. This flaw affects all plugin versions up to and including 2.31.4. The vulnerability arises from inadequate input sanitization and output escaping within the plugin's click-tracking and logging functionality. When this specific feature is enabled, an attacker can supply malicious payloads via the '_rt' parameter. Because the plugin publicly exposes a valid '_rt_nonce' on search-result pages, unauthenticated attackers can obtain the necessary token to submit these payloads successfully. If executed, the injected scripts run within the context of a victim's session, potentially leading to unauthorized actions or data theft. This vulnerability highlights the risks associated with improper handling of user-supplied data in WordPress plugins that maintain server-side logs of client activity.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker navigates to any search-results page on a WordPress site utilizing the vulnerable Relevanssi Premium plugin.\u003c/li\u003e\n\u003cli\u003eThe attacker extracts the '_rt_nonce' value publicly visible in the page source or network request headers.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts an HTTP request containing a malicious JavaScript payload in the '_rt' parameter.\u003c/li\u003e\n\u003cli\u003eThe attacker sends the crafted request to the plugin's click-tracking endpoint, incorporating the previously gathered '_rt_nonce'.\u003c/li\u003e\n\u003cli\u003eThe server-side code processes the request, failing to sanitize the input before storing it in the plugin's logs or click-tracking database.\u003c/li\u003e\n\u003cli\u003eA target user (typically an administrator or authorized user) views a page or report where the plugin renders the stored, malicious payload.\u003c/li\u003e\n\u003cli\u003eThe victim's browser executes the injected script in the context of the WordPress site.\u003c/li\u003e\n\u003cli\u003eThe attacker achieves their objective, such as session hijacking, unauthorized configuration changes, or exfiltration of sensitive information.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the browser of users viewing the affected content. This could result in account takeover, unauthorized modification of site settings, or the exfiltration of sensitive session data. The scope of impact is contingent upon the privilege level of the users who view the injected scripts, with the highest impact occurring if administrators are targeted.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritize immediate remediation to neutralize the vulnerability.\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ePatch CVE-2026-103426 by updating the Relevanssi Premium plugin to the version released after 2.31.4 as identified by the vendor.\u003c/li\u003e\n\u003cli\u003eDisable the click-tracking and logging feature in the Relevanssi Premium plugin settings as a temporary mitigation until the update can be applied.\u003c/li\u003e\n\u003cli\u003eAudit existing web server access logs for requests containing suspicious script content in the '_rt' parameter to identify potential past exploitation attempts.\u003c/li\u003e\n\u003cli\u003eDeploy the Sigma rules below to monitor for exploitation attempts targeting the identified endpoint.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-02T08:23:36Z","date_published":"2026-10-02T08:23:36Z","id":"https://feed.craftedsignal.io/briefs/2026-10-relevanssi-xss-e48c9d37/","summary":"Relevanssi Premium for WordPress versions 2.31.4 and earlier contain a stored cross-site scripting vulnerability in the click-tracking feature that allows unauthenticated attackers to execute arbitrary web scripts.","title":"CVE-2026-103426 Stored Cross-Site Scripting in Relevanssi Premium","url":"https://feed.craftedsignal.io/briefs/2026-10-relevanssi-xss-e48c9d37/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:relevanssi:premium:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}