Stored Cross-Site Scripting Vulnerability in Relevanssi Plugin for WordPress

CVE-2025-5016

What is CVE-2025-5016?

The Relevanssi plugin for WordPress contains a vulnerability that allows stored cross-site scripting (XSS) through Excerpt Highlights. This issue stems from inadequate input sanitization and output escaping, enabling unauthenticated attackers to inject malicious scripts into pages. When users access those pages, the scripts are executed in their browsers, potentially compromising sensitive information and user interactions. All versions of Relevanssi up to and including 4.24.5 (Free) and 2.27.6 (Premium) are affected, emphasizing the importance of updates and proper code auditing to enhance security.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References