Description

The Relevanssi Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '_rt' parameter in all versions up to, and including, 2.31.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This requires the click-tracking and logging feature to be activated in the plugin settings, and exploitation is trivially accessible to unauthenticated users because a valid _rt_nonce is publicly emitted on every search-results page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-10-02T08:17:00.210Z",
  "pubdate": "2026-10-02T08:17:00.210Z",
  "executiveSummary": "Relevanssi Premium versions up to and including 2.31.4 are susceptible to a Stored Cross-Site Scripting (XSS) vulnerability via the '_rt' parameter. This security flaw originates from inadequate input sanitization and output escaping within the plugin's click-tracking and logging functionality. Successful exploitation enables unauthenticated attackers to inject malicious JavaScript payloads into site pages, which execute within the context of the victim's browser session. The attack surface is exposed to unauthenticated users, provided the click-tracking feature is enabled. The requirement for a '_rt_nonce' is negligible, as this security token is publicly accessible on standard search-results pages. The impact includes unauthorized access to user sessions, potential credential theft, site defacement, and the execution of arbitrary actions on behalf of authenticated users, representing a significant security risk for WordPress installations utilizing this plugin.",
  "technicalDetails": "The vulnerability resides in the click-tracking and logging mechanism of the Relevanssi Premium plugin, specifically within the handling of the '_rt' parameter. Analysis indicates that the plugin fails to perform rigorous input sanitization on this parameter before storing it in the database and subsequently fails to implement secure output escaping when rendering the data in the administration interface or frontend context.\nThe attack flow begins with an unauthenticated attacker visiting a search-results page on the WordPress site. On this page, the plugin emits a valid '_rt_nonce', which is intended to validate requests but effectively lacks access control due to its public exposure. An attacker can intercept or construct a HTTP request containing a malicious payload injected into the '_rt' parameter. Because the plugin does not validate the input against expected patterns or escape it upon output, the payload is persisted in the server-side log or tracking database.\nWhen a legitimate user or administrator views a page where the injected logs are rendered, the browser interprets the malicious script as legitimate site content. This execution context allows the script to inherit the user's session privileges, enabling the attacker to perform actions such as session hijacking, unauthorized API requests, or redirection to malicious third-party domains. Since the vulnerability is a Stored XSS variant, the script remains persistent, potentially affecting any user who accesses the compromised administrative or frontend dashboard.\nThe exploit path is facilitated by the plugin's architectural design where the logging feature is enabled by default or easily configured. The lack of proper nonce-based request validation or server-side content filtering allows for the injection of arbitrary HTML/JavaScript tags (e.g., <script> tags, img onerror attributes). The exploitation does not require prior authentication, making the vulnerability trivial to execute across public-facing WordPress sites. Post-exploitation impact is severe, particularly if an administrator views the logs, as the injected script can perform administrative functions or modify plugin configurations to escalate privileges or establish persistence within the WordPress environment."
}