Relevanssi < 4.28.4 - Unauthenticated Stored XSS via Comment Content

Description

The plugin is vulnerable to Stored Cross-Site Scripting via comment content due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts in pages that execute whenever a user accesses an injected page. Exploitation depends on a non-empty value for the "Allowable tags in excerpts" setting, as the prefix-matching regex must have an allowable tag whose name is a prefix of the injected tag name.