WordPress Plugin Vulnerabilities

Relevanssi <= 4.24.5 (Free) and <= 2.27.6 (Premium) - Unauthenticated Stored Cross-Site Scripting via Excerpt Highlights

Description

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Excerpt Highlights in all versions up to, and including, 4.24.5 (Free) and 2.27.6 (Premium) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
relevanssi-premium
Fixed in 2.27.7
Plugin icon
relevanssi
Fixed in 4.24.6

References

CVE
CVE-2025-5016
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/ffb2ade3-d5ce-4459-ab83-e28cd4c84922

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
4.7 (medium)

Miscellaneous

Original Researcher
Jack Taylor
Verified
No
WPVDB ID
2682b3b9-3b06-4907-bfe0-4f31fdcab196

Timeline

Publicly Published
2025-05-30 (about 11 months ago)
Added
2025-05-30 (about 11 months ago)
Last Updated
2025-05-31 (about 11 months ago)

Other

Published
Title
Published
2022-12-07
Title
Panda Pods Repeater Field < 1.5.4 - Reflected XSS
Published
2025-10-31
Title
Inactive Logout < 3.6.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Published
2025-06-02
Title
Shared Files < 1.7.49 - Unauthenticated Stored Cross-Site Scripting via sanitize_file Function
Published
2014-08-01
Title
XVE Various Embed - JW Player Multiple Cross-Site Scripting Vulnerabilities
Published
2020-08-17
Title
Geo Magazine <= 2.0 - Unauthenticated Reflected XSS