Relevanssi Premium (<= 2.31.4) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/relevanssi-premium--2.31.4/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 02 Oct 2026 08:23:36 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCVE-2026-103426 Stored Cross-Site Scripting in Relevanssi Premiumhttps://feed.craftedsignal.io/briefs/2026-10-relevanssi-xss-e48c9d37/Fri, 02 Oct 2026 08:23:36 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-relevanssi-xss-e48c9d37/Relevanssi Premium for WordPress versions 2.31.4 and earlier contain a stored cross-site scripting vulnerability in the click-tracking feature that allows unauthenticated attackers to execute arbitrary web scripts.The Relevanssi Premium plugin for WordPress is susceptible to a stored Cross-Site Scripting (XSS) vulnerability, tracked as CVE-2026-103426. This flaw affects all plugin versions up to and including 2.31.4. The vulnerability arises from inadequate input sanitization and output escaping within the plugin's click-tracking and logging functionality. When this specific feature is enabled, an attacker can supply malicious payloads via the '_rt' parameter. Because the plugin publicly exposes a valid '_rt_nonce' on search-result pages, unauthenticated attackers can obtain the necessary token to submit these payloads successfully. If executed, the injected scripts run within the context of a victim's session, potentially leading to unauthorized actions or data theft. This vulnerability highlights the risks associated with improper handling of user-supplied data in WordPress plugins that maintain server-side logs of client activity.

Attack Chain

  1. An attacker navigates to any search-results page on a WordPress site utilizing the vulnerable Relevanssi Premium plugin.
  2. The attacker extracts the '_rt_nonce' value publicly visible in the page source or network request headers.
  3. The attacker crafts an HTTP request containing a malicious JavaScript payload in the '_rt' parameter.
  4. The attacker sends the crafted request to the plugin's click-tracking endpoint, incorporating the previously gathered '_rt_nonce'.
  5. The server-side code processes the request, failing to sanitize the input before storing it in the plugin's logs or click-tracking database.
  6. A target user (typically an administrator or authorized user) views a page or report where the plugin renders the stored, malicious payload.
  7. The victim's browser executes the injected script in the context of the WordPress site.
  8. The attacker achieves their objective, such as session hijacking, unauthorized configuration changes, or exfiltration of sensitive information.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the browser of users viewing the affected content. This could result in account takeover, unauthorized modification of site settings, or the exfiltration of sensitive session data. The scope of impact is contingent upon the privilege level of the users who view the injected scripts, with the highest impact occurring if administrators are targeted.

Recommendation

Prioritize immediate remediation to neutralize the vulnerability.

  • Patch CVE-2026-103426 by updating the Relevanssi Premium plugin to the version released after 2.31.4 as identified by the vendor.
  • Disable the click-tracking and logging feature in the Relevanssi Premium plugin settings as a temporary mitigation until the update can be applied.
  • Audit existing web server access logs for requests containing suspicious script content in the '_rt' parameter to identify potential past exploitation attempts.
  • Deploy the Sigma rules below to monitor for exploitation attempts targeting the identified endpoint.
]]>highadvisoryweb-applicationxss