{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/relevanssi--a-better-search--4.28.5/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:relevanssi:relevanssi:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-116522"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Relevanssi – A Better Search (\u003c= 4.28.5)"],"_cs_severities":["high"],"_cs_tags":["wordpress","xss","web-application","cms"],"_cs_type":"advisory","_cs_vendors":["Relevanssi"],"content_html":"\u003cp\u003eThe Relevanssi - A Better Search plugin for WordPress contains a stored cross-site scripting vulnerability caused by insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts via the 'comment' parameter. The vulnerability only triggers when the target WordPress site has both 'comment indexing' and 'comment highlighting' options enabled, and a user visits a singular page via a search-result permalink that includes the highlight query parameter.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of a user's browser session.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpdate the Relevanssi - A Better Search plugin to version 4.28.6 or higher, once available.\u003c/li\u003e\n\u003cli\u003eDisable the 'comment indexing' and 'comment highlighting' features in the Relevanssi plugin settings as a temporary mitigation if patching is not immediately feasible.\u003c/li\u003e\n\u003cli\u003eAudit existing comment content for suspicious script tags or obfuscated JavaScript.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-31T07:52:17Z","date_published":"2026-10-31T07:52:17Z","id":"https://feed.craftedsignal.io/briefs/2026-10-relevanssi-xss-a6ce5e25/","summary":"The Relevanssi - A Better Search plugin for WordPress (v4.28.5 and earlier) is vulnerable to stored cross-site scripting (XSS) via the comment parameter, allowing unauthenticated attackers to execute arbitrary scripts when specific search-highlighting features are enabled.","title":"Relevanssi WordPress plugin: Stored Cross-Site Scripting (CVE-2026-116522)","url":"https://feed.craftedsignal.io/briefs/2026-10-relevanssi-xss-a6ce5e25/"}],"language":"en","title":"CraftedSignal Threat Feed - Relevanssi – A Better Search (\u003c= 4.28.5)","version":"https://jsonfeed.org/version/1.1"}