CVE-2026-97641: Relevanssi WordPress Plugin XSS Vulnerability

CVE-2026-97641 Overview

CVE-2026-97641 is a stored cross-site scripting (XSS) vulnerability in the Relevanssi – A Better Search plugin for WordPress. The flaw affects all versions up to and including 4.28.3. It stems from insufficient input sanitization and output escaping in comment content processed by the plugin's excerpt and highlight routines. Unauthenticated attackers can inject arbitrary web scripts that execute when users view affected pages. Exploitation requires the administrator to configure a non-empty value for the Allowable tags in excerpts setting, such as the default example <p><a><strong>, because the prefix-matching regex requires an allowable tag whose name is a prefix of the injected tag. The vulnerability is tracked under CWE-79.

Critical Impact
Unauthenticated attackers can submit comments containing crafted HTML that becomes stored XSS when rendered through Relevanssi search excerpts, enabling session theft, admin account takeover, and malicious redirects.

Affected Products

Relevanssi – A Better Search (free) plugin for WordPress, versions up to and including 4.28.3
WordPress sites with the Allowable tags in excerpts setting configured to a non-empty value
WordPress sites allowing unauthenticated comment submissions where Relevanssi indexes comment content

Discovery Timeline

2026-10-02 - CVE-2026-97641 published to NVD
2026-10-03 - Last updated in NVD database

Technical Details for CVE-2026-97641

Vulnerability Analysis

The vulnerability resides in Relevanssi's excerpt generation and highlight logic. The plugin indexes comment content and later reconstructs excerpts for display in search results and admin AJAX responses. When building these excerpts, the plugin honors the administrator-configured Allowable tags in excerpts setting using a prefix-matching regular expression rather than a strict tag allowlist. An attacker who submits a comment containing a tag name whose prefix matches an allowed tag can smuggle an unsafe element into the rendered output. Because the excerpt is injected into the DOM without proper escaping, the attacker-controlled markup executes in the browser of any user viewing the search results or admin preview.

Root Cause

The root cause combines two issues: insufficient output escaping and a permissive tag allowlist implementation. Comment-derived excerpt text was concatenated directly into HTML output in files such as lib/admin-ajax.php and lib/excerpts-highlights.php. The prefix-matching regex used to enforce the Allowable tags in excerpts setting treats configured tags as prefixes, so an entry like <a> also permits tags such as <aside onload=...> or similar. The combination allows attacker-crafted comment HTML to survive sanitization and reach the browser unescaped.

Attack Vector

An unauthenticated attacker submits a comment containing a crafted tag whose name begins with an allowed tag prefix. Relevanssi indexes the comment content and later surfaces it inside a search excerpt. When an administrator or site visitor triggers a search or opens the admin AJAX search preview, the plugin writes the attacker-supplied markup into the response. The browser executes the injected JavaScript in the context of the WordPress origin, enabling cookie theft, forced actions, or administrator account compromise if an admin triggers the payload.

php

// Patch in lib/admin-ajax.php - excerpt now passed through wp_kses_post()
$post_element .= '</div>';

if ( ! empty( $post->post_excerpt ) ) {
-    $post_element .= '<div class="relevanssi-result-excerpt" style="font-size: 13.5px; line-height: 1.6; color: #4f565d; border-top: 1px solid #f0f0f1; padding-top: 10px; margin: 0;">' . $post->post_excerpt . '</div>';
+    $post_element .= '<div class="relevanssi-result-excerpt" style="font-size: 13.5px; line-height: 1.6; color: #4f565d; border-top: 1px solid #f0f0f1; padding-top: 10px; margin: 0;">' . wp_kses_post( $post->post_excerpt ) . '</div>';
}
$post_element .= '</li>';

Source: GitHub Relevanssi Commit 3dddec34

php

// Patch in lib/excerpts-highlights.php - final excerpt filtered via wp_kses_post()
$post = $old_global_post; // phpcs:ignore WordPress.WP.GlobalVariablesOverride.Prohibited
}

-return $excerpt_text;
+// Excerpts may contain decoded comment entities and HTML from filters. Keep
+// the formatting while removing unsafe tags and attributes before display.
+return wp_kses_post( $excerpt_text );

Source: GitHub Relevanssi Commit 3dddec34

Detection Methods for CVE-2026-97641

Indicators of Compromise

Comments in the WordPress wp_comments table containing HTML tag names that begin with values present in the Allowable tags in excerpts setting, followed by event-handler attributes such as onload, onerror, or onmouseover.
Search result pages or admin AJAX responses from admin-ajax.php containing unexpected <script> tags or inline event handlers originating from comment-derived excerpts.
Outbound requests from administrator browsers to unfamiliar domains shortly after viewing WordPress search results or the admin search preview.

Detection Strategies

Audit the Relevanssi plugin version across managed WordPress sites and flag any instance at or below 4.28.3.
Query the comments table for suspicious payload patterns, for example tags containing on\w+= attributes or javascript: URIs, especially in unapproved comments.
Inspect HTTP responses from /wp-admin/admin-ajax.php for script content inside relevanssi-result-excerpt DOM elements.

Monitoring Recommendations

Enable WordPress audit logging for plugin configuration changes, specifically modifications to the Relevanssi Allowable tags in excerpts option.
Monitor web server logs for high volumes of unauthenticated POST requests to wp-comments-post.php from a single source.
Alert on administrator sessions that generate anomalous outbound requests immediately after visiting search result pages.

How to Mitigate CVE-2026-97641

Immediate Actions Required

Update the Relevanssi – A Better Search plugin to the version containing commit 3dddec34, which applies wp_kses_post() to excerpt output in lib/admin-ajax.php and lib/excerpts-highlights.php.
Review and, if not required, clear the Allowable tags in excerpts setting to break the prefix-matching precondition for exploitation.
Audit existing comments for stored payloads and purge or sanitize any entries containing HTML tags with event-handler attributes.

Patch Information

The Relevanssi maintainer released a fix in commit 3dddec3416fbda298e18649127f31557398d10b0. The patch routes comment-derived excerpt text through WordPress' wp_kses_post() function before output in both the admin AJAX handler and the excerpt generator. Affected files include lib/admin-ajax.php, lib/excerpts-highlights.php, and lib/indexing.php. Refer to the Wordfence Vulnerability Analysis and the upstream commit for the full change set.

Workarounds

Set the Relevanssi Allowable tags in excerpts option to an empty value to prevent the prefix-matching regex from permitting attacker-controlled tags.
Disable public commenting on posts indexed by Relevanssi, or require comment moderation so unauthenticated submissions never reach the index.
Deploy a web application firewall rule to block comment submissions containing HTML event-handler attributes such as onerror=, onload=, or onmouseover=.

bash

# Example WP-CLI commands to apply mitigations
wp plugin update relevanssi
wp option update relevanssi_excerpt_allowable_tags ''
wp option update comment_moderation 1
wp option update comment_registration 1