CVE-2026-103426

Name of the Vulnerable Software and Affected Versions Relevanssi Premium versions prior to 2.31.5

Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses them. This issue requires the click-tracking and logging feature to be enabled in the plugin settings. Exploitation is facilitated because a valid rt nonce is publicly emitted on every search-results page. The attack targets the rt parameter.

Recommendations Update Relevanssi Premium to version 2.31.5 or later. As a temporary mitigation, disable the click-tracking and logging feature in the plugin settings.