PT-2026-89753 · Comesio+1 · Relevanssi – A Better Search+1

Mutantgun

·

CVE-2026-19985

·

تاريخ النشر

2026-09-10

·

تاريخ التحديث

2026-09-11

CVSS v3.1

6.1

متوسطة

المتجهAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Relevanssi – A Better Search versions prior to 4.28.2
Description Reflected Cross-Site Scripting occurs when unauthenticated attackers trick users into clicking specially crafted links. The issue stems from insufficient input sanitization and output escaping in the relevanssi debug array() function within lib/debug.php, which uses print r() to dump user-supplied query variables inside a 
 block without HTML escaping. This behavior is triggered when the relevanssi debug=on request parameter is supplied and the administrator has enabled the Debugging mode setting. The vulnerability affects the s, post types, and orderby request parameters. The debug path lacks capability, nonce, or logged-in checks.


Recommendations
Update to version 4.28.2 or later.
Disable the Debugging mode setting in the plugin configuration.
Avoid using the s, post types, and orderby parameters in conjunction with the relevanssi debug=on parameter.

إصلاح

XSS

وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
dbugs@ptsecurity.com

تصنيف نقاط الضعف

CWE-79

المعرّفات ذات الصلة

CVE-2026-19985

المنتجات المتأثرة

Relevanssi – A Better Search
Relevanssi