Relevanssi <= 4.28.5 - Unauthenticated HTML Injection via Comment Highlighting
- ID
- WPSEC-2026-1794
- Plugin
- Relevanssi – A Better Search (relevanssi)
- Affected
- all versions before 4.28.6
- Remediation
- Update to 4.28.6 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-80
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-27
- Attack surface
- Relevanssi on WPSec AttackSurface
- Fix released
- Published
Description
The Relevanssi – A Better Search plugin for WordPress is vulnerable to HTML Injection via the 'Highlight terms in comments' feature in all versions up to, and including, 4.28.5. This is due to the relevanssi_highlight_in_docs() function, hooked to comment_text, decoding HTML entities in comment content and then re-sanitizing it with the broader post-content allowlist instead of the comment allowlist. This makes it possible for unauthenticated attackers to post comments containing entity-encoded markup that is rendered as HTML elements (such as images, forms and styled elements) normally disallowed in comments. The markup appears when a user opens the post through a link carrying the 'highlight' parameter. Exploitation requires the non-default 'Highlight terms in comments' option to be enabled.
References
- https://wpsec.com/vuln/WPSEC-2026-1794/
- https://plugins.svn.wordpress.org/relevanssi/tags/4.28.6/
- https://wordpress.org/plugins/relevanssi/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS