CVE-2026-116522: Stored Cross-Site Scripting Vulnerability in Relevanssi – A Better Search WordPress Plugin
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'comment' parameter in all versions up to, and including, 4.28.5. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts, which execute when a user accesses an injected page. The exploit requires specific conditions, including enabled comment indexing and highlighting options. Immediate patching is recommended.