Stored Cross-Site Scripting in Relevanssi Plugin for WordPress

CVE-2026-97641

What is CVE-2026-97641?

The Relevanssi plugin for WordPress is susceptible to stored cross-site scripting (XSS) vulnerabilities due to insufficient sanitization of comment content. An unauthenticated attacker can exploit this flaw by injecting harmful web scripts into comments that will be executed whenever a user accesses the affected page. The risk is heightened when the site's administrator permits certain HTML tags in excerpts or comments, as the plugin's regex for allowable tags may inadvertently permit injection of malicious code. It is crucial for users to update the plugin to mitigate this vulnerability.

References