Relevanssi – A Better Search (<= 4.28.5) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/relevanssi--a-better-search--4.28.5/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSat, 31 Oct 2026 07:52:17 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgRelevanssi WordPress plugin: Stored Cross-Site Scripting (CVE-2026-116522)https://feed.craftedsignal.io/briefs/2026-10-relevanssi-xss-a6ce5e25/Sat, 31 Oct 2026 07:52:17 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-relevanssi-xss-a6ce5e25/The Relevanssi - A Better Search plugin for WordPress (v4.28.5 and earlier) is vulnerable to stored cross-site scripting (XSS) via the comment parameter, allowing unauthenticated attackers to execute arbitrary scripts when specific search-highlighting features are enabled.The Relevanssi - A Better Search plugin for WordPress contains a stored cross-site scripting vulnerability caused by insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts via the 'comment' parameter. The vulnerability only triggers when the target WordPress site has both 'comment indexing' and 'comment highlighting' options enabled, and a user visits a singular page via a search-result permalink that includes the highlight query parameter.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the context of a user's browser session.

Recommendation

  • Update the Relevanssi - A Better Search plugin to version 4.28.6 or higher, once available.
  • Disable the 'comment indexing' and 'comment highlighting' features in the Relevanssi plugin settings as a temporary mitigation if patching is not immediately feasible.
  • Audit existing comment content for suspicious script tags or obfuscated JavaScript.
]]>highadvisorywordpressxssweb-applicationcms