Vulnerabilities and security researches forrelevanssi relevanssi
Direction: descendingOct 26, 2026
Relevanssi – A Better Search # CVE-2026-114704
- CVE, Research URL
- Home page URL
- Application
- Date
- Oct 24, 2026
- Research Description
- Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4.
- Affected versions
-
max 4.28.5.
- Status
-
vulnerable
Oct 05, 2026
Relevanssi – A Better Search # CVE-2026-97641
- CVE, Research URL
- Home page URL
- Application
- Date
- Oct 02, 2026
- Research Description
- The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content in all versions up to, and including, 4.28.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This is only exploitable when the administrator has configured a non-empty value for the "Allowable tags in excerpts" setting, such as the default example value of <p><a><strong>, as the prefix-matching regex must have an allowable tag whose name is a prefix of the injected tag name.
- Affected versions
-
max 4.28.4.
- Status
-
vulnerable
Sep 12, 2026
Relevanssi – A Better Search # CVE-2026-19985
- CVE, Research URL
- Home page URL
- Application
- Date
- Sep 11, 2026
- Research Description
- The Relevanssi – A Better Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.28.1 via the 's', 'post_types', and 'orderby' request parameters. This is due to insufficient input sanitization and output escaping in the relevanssi_debug_array() function in lib/debug.php, which dumps user-supplied query variables through print_r() inside a <pre> block without HTML escaping. The debug path is enabled by supplying the relevanssi_debug=on request parameter when the administrator has previously enabled the 'Debugging mode' setting; the gate itself is a configuration check with no capability, nonce, or logged-in check (the vendor explicitly suppresses nonce verification on that line). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
- Affected versions
-
max 4.28.2.
- Status
-
vulnerable
Aug 06, 2026
Relevanssi – A Better Search # CVE-2026-15941
- CVE, Research URL
- Home page URL
- Application
- Date
- Aug 05, 2026
- Research Description
- The plugin provides an Admin Search page that allows users with the `edit_posts` capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded `args` parameter, parses it into a `WP_Query`, and then passes user-controlled taxonomy query data into Relevanssi's taxonomy restriction builder. The taxonomy value is sanitized as text but is not parameterized for SQL before being interpolated into a term taxonomy lookup query. This allows an authenticated contributor-level attacker to inject SQL through the Admin Search AJAX request and execute time-based blind SQL injection against the WordPress database.
- Affected versions
-
max 4.27.2.
- Status
-
vulnerable
Jun 16, 2026
Relevanssi – A Better Search # 9ca33785bb0628030ed75b2ba3f6308cb414be9d
- CVE, Research URL
- Home page URL
- Application
- Date
- Feb 25, 2014
- Research Description
- Relevanssi – A Better Search [relevanssi] < 3.3.1 Relevanssi <= 3.3 - SQL Injection The Relevanssi plugin for WordPress is vulnerable to SQL Injection via the ‘category_name’ parameter in versions up to, and including, 3.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Affected versions
-
max 3.3.1.
- Status
-
vulnerable
Relevanssi – A Better Search # c0c27674-715e-464d-ab38-0774128e6741
- CVE, Research URL
- Home page URL
- Application
- Date
- -
- Research Description
- Relevanssi – A Better Search [relevanssi] < 4.14.6 Relevanssi - Subscriber+ Unauthorised AJAX Calls The plugins do not have authorisation and CSRF checks in some of their AJAX actions, allowing any authenticated users, such as subscriber, to call them. This could disclose information to subscribers, as well as allow them to truncate the index, which will disable the search
- Affected versions
-
max 4.14.6.
- Status
-
vulnerable
Relevanssi – A Better Search # c9f5e1b2369a93bc990d545aff97629a10b54712
- CVE, Research URL
- Home page URL
- Application
- Date
- Feb 15, 2022
- Research Description
- Relevanssi – A Better Search [relevanssi] < 4.14.6 Relevanssi – A Better Search < 4.14.6 & Relevanssi – A Better Search Pro < 2.16.5 - Missing Authorization The Relevanssi – A Better Search plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several functions in versions before 4.14.6 in the free version and 2.16.5 in the PRO version. This makes it possible for authenticated attackers with Subscriber-level roles and above to perform unauthorized AJAX actions.
- Affected versions
-
max 4.14.6.
- Status
-
vulnerable
Relevanssi – A Better Search # 7cc11925a2930251c4369580d9374702abc4b8e9
- CVE, Research URL
- Home page URL
- Application
- Date
- Oct 19, 2021
- Research Description
- Relevanssi – A Better Search [relevanssi] < 4.14.4 Relevanssi - A Better Search Free & Premium <= 2.16.3 & 4.14.3 - Stored Cross-Site Scripting The Relevanssi - A Better Search Free & Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘$query_link ’ parameter in versions up to, and including, 2.16.3 & 4.14.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
max 4.14.4.
- Status
-
vulnerable
Relevanssi – A Better Search # 7bfa7991667663a75517e65650f2fcd4e823aaea
- CVE, Research URL
- Home page URL
- Application
- Date
- Oct 19, 2021
- Research Description
- Relevanssi – A Better Search [relevanssi] < 4.14.3 WordPress Relevanssi plugin <= 4.14.2 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability discovered in WordPress Relevanssi plugin (versions <= 4.14.2).
- Affected versions
-
max 4.14.3.
- Status
-
vulnerable
Relevanssi – A Better Search # df21da3493d505c0d60078b5df61ea0d06c877c0
- CVE, Research URL
- Home page URL
- Application
- Date
- Feb 24, 2011
- Research Description
- Relevanssi – A Better Search [relevanssi] < 2.7.3 WordPress Relevanssi Plugin 2.7.2- Stored XSS Relevanssi plugin is prone to a stored cross-site scripting vulnerability that exists because of "search Query" variable is displayed and logged unsanitized in the "User Searches" section in the admin Dashboard. This vulnerability allows an attacker to inject malicious HTML code.
- Affected versions
-
max 2.7.3.
- Status
-
vulnerable
Relevanssi – A Better Search # ecad5442ac171e61d727b8da522a107a38255289
- CVE, Research URL
- Home page URL
- Application
- Date
- May 15, 2015
- Research Description
- Relevanssi – A Better Search [relevanssi] < 3.3 WordPress Relevanssi Plugin <= 3.2 - SQL Injection Because of this vulnerability, remote authenticated users can execute arbitrary SQL commands. Update the plugin.
- Affected versions
-
max 3.3.
- Status
-
vulnerable
Relevanssi – A Better Search # 54bed89c3662291f27ed3be9c9ceaf08299ac168
- CVE, Research URL
- Home page URL
- Application
- Date
- Mar 04, 2014
- Research Description
- Relevanssi – A Better Search [relevanssi] < 3.4 WordPress Relevanssi Plugin - SQL Injection Relevanssi plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Update the plugin.
- Affected versions
-
max 3.4.
- Status
-
vulnerable
Relevanssi – A Better Search # a3cd21694e8358309f561ae40c7fe677b58a4501
- CVE, Research URL
- Home page URL
- Application
- Date
- Feb 15, 2022
- Research Description
- Relevanssi – A Better Search [relevanssi] < 4.14.6 WordPress Relevanssi – A Better Search plugin <= 4.14.5 - Unauthorized AJAX Calls vulnerability Unauthorized AJAX Calls vulnerability discovered by Jan w Oleju in WordPress Relevanssi – A Better Search plugin (versions <= 4.14.5).
- Affected versions
-
max 4.14.6.
- Status
-
vulnerable
Relevanssi – A Better Search # 8829d03c0347f2b086f6a549f57d6637abb356d7
- CVE, Research URL
- Home page URL
- Application
- Date
- Apr 10, 2018
- Research Description
- Relevanssi – A Better Search [relevanssi] < 3.6.1 Relevanssi <= 3.6.0 - Authenticated (Admin+) SQL Injection The Relevanssi plugin for WordPress is vulnerable to generic SQL Injection via the ‘relevanssi_weight_’ parameter in versions up to, and including, 3.6.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with administrative privileges to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Affected versions
-
max 3.6.1.
- Status
-
vulnerable
Relevanssi – A Better Search # a80953be-7032-412e-ba8c-33c04e16ba34
- CVE, Research URL
- Home page URL
- Application
- Date
- -
- Research Description
- Relevanssi – A Better Search [relevanssi] < 3.3 Relevanssi 3.2 - Unspecified SQL Injection The Relevanssi – A Better Search WordPress plugin was affected by an Unspecified SQL Injection security vulnerability.
- Affected versions
-
max 3.3.
- Status
-
vulnerable
Relevanssi – A Better Search # ad08bd11-e4b0-4bb1-9481-3c9651f50466
- CVE, Research URL
- Home page URL
- Application
- Date
- -
- Research Description
- Relevanssi – A Better Search [relevanssi] < 4.14.3 Relevanssi - A Better Search < 4.14.3 - Unauthenticated Stored Cross-Site Scripting The plugin does not sanitise and escape user searches before outputting them in the related admin dashboard when the feature is enabled
- Affected versions
-
max 4.14.3.
- Status
-
vulnerable
Relevanssi – A Better Search # 04c725bb-7972-479f-88da-44b2d91f6698
- CVE, Research URL
- Home page URL
- Application
- Date
- -
- Research Description
- Relevanssi – A Better Search [relevanssi] < 3.6.1 Relevanssi <= 3.6.0 - Authenticated Admin SQL Injection The Relevanssi – A Better Search WordPress plugin was affected by an Authenticated Admin SQL Injection security vulnerability.
- Affected versions
-
max 3.6.1.
- Status
-
vulnerable
Relevanssi – A Better Search # b072ba14-b3d8-45c9-9375-1e66066ed398
- CVE, Research URL
- Home page URL
- Application
- Date
- -
- Research Description
- Relevanssi – A Better Search [relevanssi] < 2.7.3 Relevanssi 2.7.2 - Stored XSS The Relevanssi – A Better Search WordPress plugin was affected by a Stored XSS security vulnerability.
- Affected versions
-
max 2.7.3.
- Status
-
vulnerable
Relevanssi – A Better Search # 50480344516a6faeef3c18ba92facd77a54898f1
- CVE, Research URL
- Home page URL
- Application
- Date
- -
- Research Description
- Relevanssi – A Better Search [relevanssi] < 4.22 WordPress Relevanssi Plugin < 4.22 is vulnerable to Sensitive Data Exposure Update the WordPress Relevanssi plugin to the latest available version (at least 4.22). An unknown person discovered and reported this Sensitive Data Exposure vulnerability in WordPress Relevanssi Plugin. This vulnerability has been fixed in version 4.22. Have additional information or questions about this entry? Get in touch.
- Affected versions
-
max 4.22.
- Status
-
vulnerable
Jan 27, 2026
Relevanssi – A Better Search # CVE-2025-14719
- CVE, Research URL
- Home page URL
- Application
- Date
- Jan 07, 2026
- Research Description
- The Relevanssi WordPress plugin before 4.26.0, Relevanssi Premium WordPress plugin before 2.29.0 do not sanitize and escape a parameter before using it in a SQL statement, allowing contributor and above roles to perform SQL injection attacks
- Affected versions
-
max 4.26.0.
- Status
-
vulnerable
Jun 02, 2025
Relevanssi – A Better Search # CVE-2025-5016
- CVE, Research URL
- Home page URL
- Application
- Date
- May 31, 2025
- Research Description
- The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Excerpt Highlights in all versions up to, and including, 4.24.5 (Free) and 2.27.6 (Premium) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
- Affected versions
-
max 4.24.6.
- Status
-
vulnerable
May 13, 2025
Relevanssi – A Better Search # CVE-2025-4396
- CVE, Research URL
- Home page URL
- Application
- Date
- May 13, 2025
- Research Description
- The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to, and including, 4.24.4 (Free) and <= 2.27.5 (Premium) due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries to already existing queries that can be used to extract sensitive information from the database.
- Affected versions
-
max 4.24.5.
- Status
-
vulnerable
May 07, 2025
Relevanssi – A Better Search # CVE-2025-4054
- CVE, Research URL
- Home page URL
- Application
- Date
- May 07, 2025
- Research Description
- The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the highlights functionality in all versions up to, and including, 4.24.3 (Free) and <= 2.27.4 (Premium), due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page via the search results.
- Affected versions
-
max 4.24.4.
- Status
-
vulnerable
Oct 10, 2024
Relevanssi – A Better Search # CVE-2024-9021
- CVE, Research URL
- Home page URL
- Application
- Date
- Oct 08, 2024
- Research Description
- In the process of testing the Relevanssi WordPress plugin before 4.23.1, a vulnerability was found that allows you to implement Stored XSS on behalf of the Contributor+ by embedding malicious script, which entails account takeover backdoor
- Affected versions
-
max 4.23.1.
- Status
-
vulnerable
Aug 16, 2024
Relevanssi – A Better Search # CVE-2024-7630
- CVE, Research URL
- Home page URL
- Application
- Date
- Aug 16, 2024
- Research Description
- The Relevanssi – A Better Search plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.22.2 (Free) and 2.25.1 (Premium) via the relevanssi_do_query() due to insufficient limitations on the posts that are returned when searching. This makes it possible for unauthenticated attackers to extract potentially sensitive information from password protected posts.
- Affected versions
-
max 4.23.0.
- Status
-
vulnerable
Jun 07, 2024
Relevanssi – A Better Search # CVE-2014-9443
- CVE, Research URL
- Home page URL
- Application
- Date
- Jan 03, 2015
- Research Description
- Cross-site scripting (XSS) vulnerability in the Relevanssi plugin before 3.3.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
- Affected versions
-
max 3.3.8.
- Status
-
vulnerable
Relevanssi – A Better Search # CVE-2018-9034
- CVE, Research URL
- Home page URL
- Application
- Date
- Apr 05, 2018
- Research Description
- Cross-site scripting (XSS) vulnerability in lib/interface.php of the Relevanssi plugin 4.0.4 for WordPress allows remote attackers to inject arbitrary JavaScript or HTML via the tab GET parameter.
- Affected versions
-
max 4.0.5.
- Status
-
vulnerable
Relevanssi – A Better Search # CVE-2017-1000038
- CVE, Research URL
- Home page URL
- Application
- Date
- Jul 17, 2017
- Research Description
- WordPress plugin Relevanssi version 3.5.7.1 is vulnerable to stored XSS resulting in attacker being able to execute JavaScript on the affected site
- Affected versions
-
max 3.5.8.
- Status
-
vulnerable
Relevanssi – A Better Search # CVE-2023-7199
- CVE, Research URL
- Home page URL
- Application
- Date
- Jan 29, 2024
- Research Description
- The Relevanssi WordPress plugin before 4.22.0, Relevanssi Premium WordPress plugin before 2.25.0 allows any unauthenticated user to read draft and private posts via a crafted request
- Affected versions
-
max 4.22.0.
- Status
-
vulnerable
Relevanssi – A Better Search # CVE-2024-3213
- CVE, Research URL
- Home page URL
- Application
- Date
- Apr 10, 2024
- Research Description
- The Relevanssi – A Better Search plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the relevanssi_update_counts() function in all versions up to, and including, 4.22.1. This makes it possible for unauthenticated attackers to execute expensive queries on the application that could lead into DOS.
- Affected versions
-
max 4.22.2.
- Status
-
vulnerable
Relevanssi – A Better Search # CVE-2024-1380
- CVE, Research URL
- Home page URL
- Application
- Date
- Mar 13, 2024
- Research Description
- The Relevanssi – A Better Search plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relevanssi_export_log_check() function in all versions up to, and including, 4.22.0 (Free) and 2.25.0 (Premium). This makes it possible for unauthenticated attackers to export the query log data. The vendor has indicated that they may look into adding a capability check for proper authorization control, however, this vulnerability is theoretically patched as is.
- Affected versions
-
max 4.22.1.
- Status
-
vulnerable
Relevanssi – A Better Search # CVE-2024-3214
- CVE, Research URL
- Home page URL
- Application
- Date
- Apr 10, 2024
- Research Description
- The Relevanssi – A Better Search plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 4.22.1. This makes it possible for unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
- Affected versions
-
max 4.22.2.
- Status
-
vulnerable