Stored Cross-Site Scripting in Relevanssi – A Better Search for WordPress
CVE-2025-4054
6.1MEDIUM
What is CVE-2025-4054?
The Relevanssi – A Better Search plugin for WordPress is affected by a vulnerability that allows unauthenticated attackers to exploit the highlights feature. Due to inadequate input sanitization and output escaping, attackers can inject malicious web scripts into pages. These scripts can execute when users access the manipulated pages through search results. This vulnerability affects all versions up to 4.24.3, posing a significant security risk to WordPress sites utilizing this plugin.
Affected Version(s)
Relevanssi – A Better Search * <= 4.24.3
References
CVSS V3.1
Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Jack Taylor