CVE-2026-116522
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
The Relevanssi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in versions up to 4.28.5 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user visits an injected page. This requires comment indexing and highlighting enabled, and the payload fires when a visitor reaches a singular page via a Relevanssi search-result permalink with the highlight query parameter.
Risk Assessment
Potential execution of malicious JavaScript in the user's browser, which could lead to session or data theft. The risk applies to sites with comment indexing and highlighting enabled.
Recommendation
Update the Relevanssi plugin to a version later than 4.28.5. If updating is not possible, consider disabling comment indexing and highlighting.
Other vulnerabilities in Relevanssi
See all- CVE-2026-114704High
The Relevanssi plugin for WordPress (versions up to 4.28.4) contains a deserialization of untrusted data vulnerability that allows object injection. The issue affects versions from n/a through 4.28.4.
- CVE-2026-15941Medium
The Relevanssi plugin provides an Admin Search page that allows users with the `edit_posts` capability to run searches. The AJAX handler parses a user-controlled `args` parameter and passes taxonomy data to the restriction builder, where the value is not parameterized before being interpolated into a SQL query. This allows an authenticated contributor-level attacker to perform time-based blind SQL injection.
Original NVD description (English source)
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.28.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the site to have both the comment indexing and comment highlighting options enabled, and the payload only fires when a visitor reaches a singular page via a Relevanssi search-result permalink carrying the highlight query parameter.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS