CVE-2026-116522 comesio CVE debrief

Who should care

Defenders responsible for WordPress installations with the Relevanssi plugin should assess exposure and prioritize updating the plugin to prevent exploitation. This includes reviewing the plugin's configuration, monitoring for suspicious activity, and implementing additional security measures to prevent cross-site scripting attacks.

Why it matters

Defenders should prioritize verifying and updating the Relevanssi plugin to prevent exploitation, as this vulnerability allows unauthenticated attackers to inject arbitrary web scripts.

• Unauthenticated attackers can inject arbitrary web scripts
• Scripts execute when a user accesses an injected page
• Requires comment indexing and comment highlighting options to be enabled

Technical summary

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.28.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page, requiring both comment indexing and comment highlighting options to be enabled. The vulnerability can be exploited via a Relevanssi search-result permalink with a highlight query parameter.

Defensive priority

Defenders should prioritize verifying and updating the Relevanssi plugin to prevent exploitation.

Recommended defensive actions

• Verify and update the Relevanssi plugin to the latest version
• Review and restrict user input to prevent cross-site scripting
• Monitor for suspicious activity on the website
• Perform a thorough review of the website's comment section for any suspicious activity
• Implement additional security measures such as Web Application Firewall (WAF) rules to detect and prevent cross-site scripting attacks
• Conduct regular security audits to identify potential vulnerabilities
• Keep track of plugin updates and security advisories

Evidence notes

The vulnerability exists in the Relevanssi plugin's handling of the 'comment' parameter, allowing unauthenticated attackers to inject arbitrary web scripts. This requires the site to have both the comment indexing and comment highlighting options enabled. The payload only fires when a visitor reaches a singular page via a Relevanssi search-result permalink carrying the highlight query parameter. Evidence is limited to public CVE details and vendor advisory information.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.