# Relevanssi <= 4.28.5 - Unauthenticated HTML Injection via Comment Highlighting

- **ID:** WPSEC-2026-1794
- **Plugin:** Relevanssi – A Better Search (`relevanssi`), https://wordpress.org/plugins/relevanssi/
- **Affected versions:** all versions before 4.28.6
- **Fixed in:** 4.28.6 (Update to 4.28.6 or later.)
- **Severity:** Medium 4.7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-80
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-28)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/relevanssi
- **Fix released:** 2026-10-27
- **Published:** 2026-10-28
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1794/

## Description

The Relevanssi – A Better Search plugin for WordPress is vulnerable to HTML Injection via the 'Highlight terms in comments' feature in all versions up to, and including, 4.28.5. This is due to the relevanssi_highlight_in_docs() function, hooked to comment_text, decoding HTML entities in comment content and then re-sanitizing it with the broader post-content allowlist instead of the comment allowlist. This makes it possible for unauthenticated attackers to post comments containing entity-encoded markup that is rendered as HTML elements (such as images, forms and styled elements) normally disallowed in comments. The markup appears when a user opens the post through a link carrying the 'highlight' parameter. Exploitation requires the non-default 'Highlight terms in comments' option to be enabled.

## References

- https://wpsec.com/vuln/WPSEC-2026-1794/
- https://plugins.svn.wordpress.org/relevanssi/tags/4.28.6/
- https://wordpress.org/plugins/relevanssi/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1794/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.