Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-09-11
Relevanssi – A Better Search - Cross-Site Scripting (XSS) (CVE-2026-19985)
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.28.1 via the 's', 'post_types', and 'orderby' request parameters. This is due to insufficient input sanitization and output escaping in the relevanssi_debug_array() function in lib/debug.php, which dumps user-supplied query variables through print_r() inside a block without HTML escaping. The debug path is enabled by supplying the relevanssi_debug=on request parameter when the administrator has previously enabled the 'Debugging mode' setting; the gate itself is a configuration check with no capability,…
PLUGIN
Relevanssi – A Better Search
CVE-2026-19985
Risk Score
Threat Entry
Updated 2026-06-17
Relevanssi - A Better Search - Cross-Site Scripting (XSS) (CVE-2025-5016)
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Excerpt Highlights in all versions up to, and including, 4.24.5 (Free) and 2.27.6 (Premium) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
PLUGIN
Relevanssi - A Better Search
CVE-2025-5016
Risk Score
Threat Entry
Updated 2026-06-17
Relevanssi – A Better Search - SQL Injection (CVE-2025-4396)
The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to, and including, 4.24.4 (Free) and
PLUGIN
Relevanssi – A Better Search
CVE-2025-4396
Risk Score
Threat Entry
Updated 2026-06-17
Relevanssi - A Better Search - Cross-Site Scripting (XSS) (CVE-2025-4054)
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the highlights functionality in all versions up to, and including, 4.24.3 (Free) and
PLUGIN
Relevanssi - A Better Search
CVE-2025-4054
Risk Score
Threat Entry
Updated 2026-06-17
Relevanssi - A Better Search - Information Disclosure (CVE-2024-7630)
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 4.22.2 (Free) and 2.25.1 (Premium) via the relevanssi_do_query() due to insufficient limitations on the posts that are returned when searching. This makes it possible for unauthenticated attackers to extract potentially sensitive information from password protected posts.
PLUGIN
Relevanssi - A Better Search
CVE-2024-7630
Risk Score
Threat Entry
Updated 2026-06-17
Relevanssi - A Better Search - Security Vulnerability (CVE-2024-3214)
The Relevanssi – A Better Search plugin for WordPress is vulnerable to CSV Injection in all versions up to, and including, 4.22.1. This makes it possible for unauthenticated attackers to embed untrusted input into exported CSV files, which can result in code execution when these files are downloaded and opened on a local system with a vulnerable configuration.
PLUGIN
Relevanssi - A Better Search
CVE-2024-3214
Risk Score
Threat Entry
Updated 2026-06-17
Relevanssi - A Better Search - Broken Access Control (CVE-2024-3213)
The Relevanssi – A Better Search plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the relevanssi_update_counts() function in all versions up to, and including, 4.22.1. This makes it possible for unauthenticated attackers to execute expensive queries on the application that could lead into DOS.
PLUGIN
Relevanssi - A Better Search
CVE-2024-3213
Risk Score
Threat Entry
Updated 2026-06-17
Relevanssi - A Better Search - Broken Access Control (CVE-2024-1380)
The Relevanssi – A Better Search plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the relevanssi_export_log_check() function in all versions up to, and including, 4.22.0 (Free) and 2.25.0 (Premium). This makes it possible for unauthenticated attackers to export the query log data. The vendor has indicated that they may look into adding a capability check for proper authorization control, however, this vulnerability is theoretically patched as is.
PLUGIN
Relevanssi - A Better Search
CVE-2024-1380
Risk Score