Technical impact
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross‑Site Scripting via the Excerpt Highlights feature. Inadequate input sanitization and output escaping allow an attacker to embed arbitrary JavaScript that will execute whenever a user views an injected page, enabling credential theft, session hijacking, defacement, or deflection of traffic. The vulnerability is exploitable without any authentication and can be triggered when the attacker submits content that is saved in the excerpt highlights field.
Affected Systems
The flaw affects all free Relevanssi plugin versions up to and including 4.24.5 and all Relevanssi Premium versions up to and including 2.27.6. Administrators of WordPress sites running any of these releases are at risk.
Risk and Exploitability
With a CVSS score of 4.7 the vulnerability scores as moderate severity. The EPSS score of less than 1% indicates a low probability of exploitation at the time of this analysis, and the flaw is not listed in the CISA KEV catalog. Because it can be triggered by unauthenticated users who supply input stored in the excerpt highlights field, an attacker can plant malicious scripts that will execute in the browsers of any user who visits the affected page. The lack of authentication requirement and the widespread usage of the plugin amplify the potential impact.
EUVD