Stored Cross-Site Scripting in Relevanssi – A Better Search for WordPress

CVE-2025-4054

What is CVE-2025-4054?

The Relevanssi – A Better Search plugin for WordPress is affected by a vulnerability that allows unauthenticated attackers to exploit the highlights feature. Due to inadequate input sanitization and output escaping, attackers can inject malicious web scripts into pages. These scripts can execute when users access the manipulated pages through search results. This vulnerability affects all versions up to 4.24.3, posing a significant security risk to WordPress sites utilizing this plugin.

References