CVE-2025-5016 Overview
CVE-2025-5016 is a stored Cross-Site Scripting (XSS) vulnerability in the Relevanssi – A Better Search plugin for WordPress. The flaw affects the Excerpt Highlights feature in all versions up to and including 4.24.5 (Free) and 2.27.6 (Premium). The plugin fails to sanitize user-supplied input and escape output before rendering excerpts on search result pages. Unauthenticated attackers can inject arbitrary JavaScript that executes when a user views an affected page. The issue is tracked as [CWE-79], Improper Neutralization of Input During Web Page Generation.
Critical Impact
Unauthenticated attackers can inject persistent JavaScript into WordPress pages using Relevanssi, enabling session theft, credential harvesting, and admin account takeover when victims interact with poisoned search results.
Affected Products
- Relevanssi – A Better Search (Free) versions up to and including 4.24.5
- Relevanssi – A Better Search (Premium) versions up to and including 2.27.6
- WordPress installations with the Relevanssi plugin active
Discovery Timeline
- 2025-05-31 - CVE-2025-5016 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-5016
Vulnerability Analysis
The vulnerability resides in the excerpt highlighting logic implemented in lib/excerpts-highlights.php within the Relevanssi plugin. Relevanssi generates excerpts from search results and wraps matched query terms in highlight markup. The routine treats the incoming search query as trusted content and reflects it into the excerpt HTML without sufficient neutralization.
Because search queries can be delivered through the s URL parameter, an attacker can craft a link containing JavaScript payloads embedded in the query string. When another user follows that link or lands on a page rendering the manipulated excerpt, the script executes in the browser under the origin of the WordPress site.
The stored classification stems from search interactions that persist in cached results, indexed excerpts, or search-driven page content. Injected scripts can then trigger for any visitor viewing the affected view. Impact scenarios include session cookie theft, forced administrative actions through CSRF chains, defacement, and redirection to malware distribution infrastructure.
Root Cause
The root cause is insufficient input sanitization and missing output escaping in the excerpt generation path. The plugin does not apply WordPress escaping functions such as esc_html() or wp_kses() to user-controlled content before merging it into HTML output. Reference the vulnerable location at WordPress Relevanssi Code Reference.
Attack Vector
Exploitation requires user interaction, typically a victim clicking a crafted URL or viewing a page where a poisoned excerpt is rendered. No authentication is required to inject the payload. The attack executes over the network against the target WordPress site. Additional context is available in Wordfence Vulnerability Intelligence.
Detection Methods for CVE-2025-5016
Indicators of Compromise
- Web server access logs containing search requests with <script>, onerror=, javascript:, or HTML entity-encoded payloads in the s query parameter
- Unexpected outbound requests from browsers to attacker-controlled domains originating from WordPress search result pages
- New or modified administrator accounts created shortly after suspicious search traffic
- WordPress options or transient cache entries containing HTML tags within stored search terms
Detection Strategies
- Deploy a Web Application Firewall (WAF) rule that inspects the s parameter for HTML tags and JavaScript event handlers on sites running Relevanssi
- Review Relevanssi version reported by wp plugin list against fixed releases across all managed WordPress instances
- Hunt historical access logs for search query strings containing <, >, %3C, or %3E characters targeting /?s=
Monitoring Recommendations
- Alert on WordPress administrator logins that follow anomalous session cookie exports or unusual wp-admin traffic patterns
- Monitor for JavaScript execution reports from browser Content Security Policy (CSP) violation endpoints
- Track plugin file integrity for lib/excerpts-highlights.php and compare hashes against the patched release
How to Mitigate CVE-2025-5016
Immediate Actions Required
- Update the Relevanssi Free plugin to a version above 4.24.5 as soon as the vendor releases a patched build
- Update the Relevanssi Premium plugin to a version above 2.27.6
- Rotate WordPress administrator passwords and invalidate active sessions if suspicious search activity is present in logs
- Review recently created users and scheduled tasks for signs of post-exploitation activity
Patch Information
Refer to the Wordfence Vulnerability Intelligence advisory and the Relevanssi plugin repository for the fixed release notes. Apply the update through the WordPress admin dashboard or via WP-CLI once available.
Workarounds
- Temporarily deactivate Relevanssi until a patched version is installed
- Enforce a strict Content Security Policy that blocks inline script execution on public-facing pages
- Restrict access to the search endpoint using a WAF rule that rejects requests where the s parameter contains angle brackets or common XSS keywords
# Update Relevanssi using WP-CLI once a patched version is available
wp plugin update relevanssi
wp plugin list --name=relevanssi --fields=name,version,status
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
