Summary
The Relevanssi – A Better Search WordPress plugin contains a stored cross-site scripting vulnerability caused by insufficient sanitization of comment content and inadequate output escaping. Unauthenticated attackers may inject scripts that execute when a user visits an affected page, but exploitation generally requires a non-empty "Allowable tags in excerpts" setting with a matching prefix condition.
Affected context
The issue occurs in WordPress installations using the Relevanssi search plugin when comment content is incorporated into rendered excerpts without sufficient sanitization or escaping. Exploitability depends on the "Allowable tags in excerpts" setting being non-empty, such as a configuration containing HTML tag names that can satisfy the plugin's prefix-matching behavior.
Exploit preconditions
- Attack surface: Comment content processed by Relevanssi and displayed in a rendered page
- Required access: No authenticated account is generally required to submit the relevant comment content, subject to the site's comment settings
- Trigger point: A visitor or administrator views a page containing the affected excerpt
- Configuration condition: The "Allowable tags in excerpts" setting contains a non-empty value with a tag name that matches the required prefix condition
- Why exploitation is possible: Attacker-controlled content can reach the output without adequate context-aware escaping
Why this happens
The vulnerability results from treating comment-derived content as trusted markup during excerpt generation and rendering. Insufficient input sanitization combined with missing or incomplete output encoding allows attacker-controlled HTML or script-capable content to be stored and later interpreted by a browser. This behavior maps to CWE-79: Improper Neutralization of Input During Web Page Generation, commonly known as stored cross-site scripting.
Potential impact
- An attacker may execute arbitrary scripts in a visitor's browser
- Session-related information or page data could be exposed, depending on browser and application controls
- An attacker could perform actions with the victim's privileges
- Administrators may be targeted for account compromise or content manipulation
- Site reputation and visitor trust can be damaged
General mitigation guidance
Mitigation typically focuses on enforcing safe handling of untrusted comment content throughout processing and rendering.
Common defensive patterns include:
- Apply context-appropriate output escaping at the final rendering boundary
- Sanitize permitted markup using a strict allowlist rather than prefix-based tag matching
- Use secure-by-default excerpt settings that do not permit unnecessary HTML
- Reduce trust in user-submitted comments and review all transformation stages
- Apply least privilege to WordPress accounts and administrative sessions
- Use browser security controls such as a restrictive Content Security Policy where practical
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules that identify unescaped comment or excerpt data in HTML output
- Code review signals involving HTML construction, regular-expression-based tag filtering, and inconsistent escaping
- Tests that render hostile comment content under each allowable-tag configuration
- Policy enforcement requiring context-aware escaping at template and response boundaries
- Monitoring for suspicious markup in comments and unexpected script-capable content in generated excerpts
- Automated security review tools that check WordPress output-escaping and sanitization patterns
