Relevanssi – A Better Search, a popular WordPress plugin, suffers from a stored XSS flaw caused by insufficient input sanitization and output escaping for comment content. An unauthenticated attacker can embed a malicious script in a comment, which is subsequently rendered in the page generated for that comment. When users view the page, the injected script runs in their browser, enabling the attacker to hijack sessions, steal cookies, and conduct further phishing or credential‑stealing attacks. The vulnerability is a classic input‑validation weakness (CWE‑79).

The flaw affects all Relevanssi plugin installations up to and including version 4.28.3. No other product or vendor is affected according to the CNA vendor list.

The CVSS score of 7.2 indicates a moderate‑to‑high severity vulnerability. The EPSS score is not available, so the actual likelihood of exploitation is unknown, but the fact that the weakness is exploitable by unauthenticated users and depends only on an administrator’s configuration of allowable excerpt tags underscores a high risk. The plugin is not listed in the CISA KEV catalog, but attackers could easily identify and target sites that use the vulnerable version because the comment submission form is publicly accessible and can be abused to inject payloads when a non‑empty value is configured for "Allowable tags in excerpts". The exploitation path requires only that an attacker submits a comment containing a script or similar tag with a prefix matching an allowed tag; the script then executes for each visitor who views the comment.