CVE-2025-4054

Vulnerability

Overview

The Relevanssi – A Better Search plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in its highlights functionality. The flaw arises from insufficient input sanitization and output escaping, allowing untrusted data to be stored and later rendered in search result pages.

Exploitation

An unauthenticated attacker can exploit this vulnerability by injecting arbitrary web scripts into the search results through the highlights feature. When a user accesses a page that displays these search results, the injected script executes in the context of the victim's browser. No special privileges or authentication are required.

Impact

Successful exploitation enables the attacker to execute arbitrary JavaScript in the browsers of users viewing the compromised search results. This can lead to session hijacking, defacement, or redirection to malicious sites, potentially compromising user data and site integrity.

Mitigation

The vulnerability affects all versions up to and including 4.24.3 (Free) and <= 2.27.4 (Premium). Users should upgrade to the latest patched version of the plugin. For installation and update instructions, refer to the plugin's official documentation [1].