The Relevanssi – A Better Search plugin is vulnerable to Stored Cross‑Site Scripting because comment content is stored and later displayed without proper sanitization or escaping. An attacker who can submit a comment can inject arbitrary JavaScript or other payloads that will be rendered when visitors view a page containing a Relevanssi search‑result permalink with the highlight query parameter. This allows the attacker to run scripts in the context of authenticated users, enabling session hijacking, defacement, or data theft.

Vulnerability affects the Relevanssi WordPress plugin (vendor comesio) version 4.28.5 and all earlier releases. The issue is present on any WordPress site that has the plugin installed, provided that the comment indexing and comment highlighting options are enabled.

The vulnerability has a CVSS score of 7.2, indicating a high impact if exploited. EPSS data is unavailable, and the flaw is not listed in the CISA KEV catalog. Attackers can exploit the flaw without authentication, but the payload only triggers on pages accessed via a Relevanssi search‑result permalink that contains the highlight query parameter. The requirement to have comment indexing and highlighting enabled limits the attack surface but does not eliminate it; a determined attacker could still inject malicious scripts into comments and reach vulnerable pages through normal search usage.