CVE-2026-103426

Relevanssi Premium <= 2.31.4 - Unauthenticated Stored Cross-Site Scripting via '_rt' Parameter

Published Oct 2, 2026 CVSS 3.1 · 7.2 High EPSS < 1% KEV · Not listed

Description

The Relevanssi Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_rt' parameter in all versions up to, and including, 2.31.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the click-tracking and logging feature to be activated in the plugin settings, and exploitation is trivially accessible to unauthenticated users because a valid _rt_nonce is publicly emitted on every search-results page.

Analysis

Technical impact

The Relevanssi Premium plugin for WordPress contains an unsanitized '_rt' request parameter that is stored in the system. An attacker can inject arbitrary JavaScript code via this parameter, and the payload is persisted and executed whenever a user views the affected page. Because the injection does not require authentication, any user visiting the infected page can be exposed to malicious scripts that may steal session cookies, deface content, or compromise the browser.

Affected Systems

All WordPress sites that use Relevanssi Premium version 2.31.4 or earlier are affected. The vulnerability is present in every release of the plugin up to and including 2.31.4 and therefore any installation of that product and older patches carries the risk.

Risk and Exploitability

The CVSS score of 7.2 classifies the vulnerability as moderate‑to‑high severity, and the EPSS score is not available. The vulnerability is not listed in the CISA KEV catalog. The attack vector is effectively unauthenticated and trivially achievable because the plugin’s click‑tracking feature emits a public '_rt_nonce' on each search‑results page. An attacker can craft a malicious URL that an unsuspecting user might click, leading to the execution of the injected script without any special privileges.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Relevanssi

Relevanssi Premium

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.31.4

No data.

Vendor Product Versions

Relevanssi

Version	Status	Scheme	Platform
`[0,2.31.4]`	affected	semver	—

Wordpress-extensions

Relevanssi Premium

Version	Status	Scheme	Platform
`[0,2.31.4]`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Relevanssi Premium plugin to a version newer than 2.31.4, which removes the unsafe handling of the '_rt' parameter.
If an immediate update is not possible, disable the click‑tracking and logging feature in the plugin settings so that the publicly exposed '_rt_nonce' is no longer generated.
After disabling click‑tracking, clear any existing stored scripts from the search results page or reset the plugin’s cache to remove previously injected code.
As a temporary hardening step, configure the web server or a security plugin to reject requests containing the '_rt' query parameter or to sanitize its contents before processing.

Generated by OpenCVE AI on October 2, 2026 at 08:26 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.231% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://www.relevanssi.com/
https://www.wordfence.com/threat-intel/vulnerabilities/id/769a39e0-f626-4c48-a1bb-c9f2402b3098?source=cve

History

Oct 3, 2026 6:30 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Oct 2, 2026 3:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Relevanssi Relevanssi relevanssi Wordpress-extensions Wordpress-extensions relevanssi Premium
Vendors & Products		Relevanssi Relevanssi relevanssi Wordpress-extensions Wordpress-extensions relevanssi Premium

Oct 2, 2026 7:45 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The Relevanssi Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_rt' parameter in all versions up to, and including, 2.31.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the click-tracking and logging feature to be activated in the plugin settings, and exploitation is trivially accessible to unauthenticated users because a valid _rt_nonce is publicly emitted on every search-results page.
Title		Relevanssi Premium <= 2.31.4 - Unauthenticated Stored Cross-Site Scripting via '_rt' Parameter
Weaknesses		CWE-79
References		https://www.relevanssi.com/ https://www.wordfence.com/threat-intel/vulnerabilities/id/769a39e0-f626-4c48-a1bb-c9f2402b3098?source=cve
Metrics		cvssV3_1 `{'score': 7.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N'}`