Reflected Cross-Site Scripting Vulnerability in Relevanssi Plugin for WordPress

CVE-2026-19985

What is CVE-2026-19985?

The Relevanssi – A Better Search plugin for WordPress is susceptible to reflected cross-site scripting due to inadequate input sanitization and insufficient output escaping in the relevanssi_debug_array() function. This occurs when query variables are displayed directly without HTML escaping, allowing attackers to create a malicious link that triggers script execution when clicked by a user. The vulnerability is enabled when the debugging mode is activated by the administrator, thus exposing the site to potential unauthorized script injection.

References