CVE-2026-116522

Name of the Vulnerable Software and Affected Versions Relevanssi – A Better Search versions prior to 4.28.6

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on a target server. The issue occurs via the comment parameter. Exploitation requires the site to have both comment indexing and comment highlighting options enabled. The injected script executes when a visitor accesses a singular page through a Relevanssi search-result permalink that includes the highlight query parameter.

Recommendations Update to version 4.28.6 or later. Disable the comment indexing and comment highlighting options as a temporary mitigation measure.