CVE-2025-4054: Relevanssi WordPress Plugin XSS Vulnerability

CVE-2025-4054 Overview

CVE-2025-4054 affects the Relevanssi – A Better Search plugin for WordPress. The vulnerability enables Stored Cross-Site Scripting (XSS) through the plugin's highlights functionality [CWE-79]. All Free versions up to and including 4.24.3, and Premium versions up to and including 2.27.4, contain the flaw. The root cause is insufficient input sanitization and output escaping in the excerpt highlighting logic. Unauthenticated attackers can inject arbitrary web scripts into pages, which execute whenever users access an injected page via search results.

Critical Impact
Unauthenticated attackers can inject persistent JavaScript payloads that execute in the browsers of visitors reaching affected pages through Relevanssi search results, enabling session theft, credential harvesting, and site defacement.

Affected Products

Relevanssi – A Better Search (Free) versions up to and including 4.24.3
Relevanssi – A Better Search (Premium) versions up to and including 2.27.4
WordPress sites with the affected plugin installed and search functionality enabled

Discovery Timeline

2025-05-07 - CVE-2025-4054 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-4054

Vulnerability Analysis

The Relevanssi plugin extends the native WordPress search with relevance ranking and excerpt highlighting. The highlights feature emphasizes matched search terms within excerpt output rendered on search results and destination pages. The vulnerable code paths sit in lib/excerpts-highlights.php, where user-controllable search input is inserted into HTML output without sufficient sanitization or contextual escaping.

Because the highlighted content is stored and rendered within the WordPress page context, an attacker's crafted search query can result in persistent script execution against later visitors. The issue is classified under CWE-79: Improper Neutralization of Input During Web Page Generation.

Root Cause

The highlighting routines wrap matched terms in HTML markup without neutralizing script-relevant characters or enforcing an allowlist for injected content. Review of the excerpts-highlights.php source at line 508 and line 683 shows term insertion into rendered output that lacks a call to esc_html(), wp_kses(), or equivalent escaping before emission.

Attack Vector

Exploitation is remote and unauthenticated. An attacker crafts a URL containing a malicious search term with embedded HTML or JavaScript. When a victim navigates to a page reached via that search request, the plugin renders the attacker-controlled term inside the page markup, and the browser executes the payload. User interaction is required — the victim must follow the poisoned search link — but no authentication or elevated privilege is needed. The vulnerability changes security scope because script executes in the trusted origin of the WordPress site.

No verified public exploit code has been published. The vendor addressed the issue in changeset 3283795, and further detail is available in the Wordfence Vulnerability Intel entry.

Detection Methods for CVE-2025-4054

Indicators of Compromise

HTTP requests to WordPress search endpoints containing <script>, onerror=, onload=, or javascript: substrings in the s query parameter
URL-encoded payloads such as %3Cscript%3E or %3Cimg%20src in search referrers within web server access logs
Unexpected outbound requests from visitor browsers to attacker-controlled domains following searches on the affected site
Presence of the Relevanssi plugin at versions <= 4.24.3 (Free) or <= 2.27.4 (Premium) in the WordPress plugins directory

Detection Strategies

Audit web server and WAF logs for search query strings containing HTML tags, event handlers, or encoded script markers
Inspect cached search excerpts and page output for unexpected <script> elements or inline event handlers rendered inside highlight markup
Query the WordPress database for the installed Relevanssi version and confirm it is at or above the patched release
Use browser DOM inspection on search-result-linked pages to identify script tags originating from highlight wrappers

Monitoring Recommendations

Alert on anomalous spikes in requests to /?s= or /search/ containing angle brackets or encoded HTML entities
Monitor for new admin sessions, plugin installations, or user role changes that follow suspicious search traffic patterns
Enable Content Security Policy (CSP) reporting to capture inline script violations originating from plugin output

How to Mitigate CVE-2025-4054

Immediate Actions Required

Update Relevanssi Free to a version above 4.24.3 and Relevanssi Premium to a version above 2.27.4
Review WordPress access logs for prior exploitation attempts targeting the search parameter and validate integrity of cached page output
Rotate administrator session tokens and credentials if evidence of successful script execution against privileged users is found
Deploy or tighten Content Security Policy headers to restrict inline script execution as a defense-in-depth control

Patch Information

The vendor released a fix documented in WordPress Plugin Trac changeset 3283795, which corrects the sanitization and escaping logic in the highlighting functions. Installation and update guidance is provided in the Relevanssi User Manual. Site operators should upgrade through the WordPress plugin management interface or via WP-CLI.

Workarounds

Disable the Relevanssi highlights feature in plugin settings until the patched version is deployed
Deactivate the Relevanssi plugin entirely on sites where updating is not immediately possible
Configure a Web Application Firewall (WAF) rule to block search query parameters containing HTML tags or JavaScript event handlers
Restrict access to the search functionality via authentication requirements where the site's use case permits

bash

# Update Relevanssi via WP-CLI
wp plugin update relevanssi

# Verify installed version
wp plugin get relevanssi --field=version

# Temporary deactivation if patching is delayed
wp plugin deactivate relevanssi