Stored Cross-Site Scripting Vulnerability in Relevanssi Plugin for WordPress

CVE-2025-5016

What is CVE-2025-5016?

The Relevanssi plugin for WordPress contains a vulnerability that allows stored cross-site scripting (XSS) through Excerpt Highlights. This issue stems from inadequate input sanitization and output escaping, enabling unauthenticated attackers to inject malicious scripts into pages. When users access those pages, the scripts are executed in their browsers, potentially compromising sensitive information and user interactions. All versions of Relevanssi up to and including 4.24.5 (Free) and 2.27.6 (Premium) are affected, emphasizing the importance of updates and proper code auditing to enhance security.

References