Relevanssi <= 4.24.4 (Free) - Unauthenticated SQL Injection

The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to, and including, 4.24.4 Free and = 2.27.4 Premium due to insufficient escaping on the user supplied parameter and lack of sufficient...

Relevanssi (A Better Search) <= 4.22.0 - Query Log Export

The Relevanssi Search plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check in all versions up to, and including, 4.22.0. This makes it possible for unauthenticated attackers to export the query log data. id: CVE-2024-1380 info: name: Relevanssi A...

CVE-2025-4396

CVE-2025-4396 - Kit de Inyección SQL Ciega Basada en Tiempo para WordPress Relevanssi Resumen Este repositorio contiene un kit práctico de investigación y validación para CVE-2025-4396 , una Inyección SQL Ciega Basada en Tiempo sin autenticación que afecta al plugin Relevanssi de WordPress a trav...

CVE-2024-1380

CVE-2024-1380 Relevanssi – A Better Search = 4.22.0 - 缺少授权校验导致未授权查询日志导出 描述 WordPress 的 Relevanssi – A Better Search 插件在所有版本（包括 4.22.0）中，由于 relevanssiexportlogcheck 函数缺少权限检查，存在数据未授权访问的风险。这使得未认证的攻击者能够导出查询日志数据。供应商表示他们可能会考虑添加权限检查以实现适当的授权控制，但理论上该漏洞已通过现有方式修复。 参考资料 plugins.trac.wordpress.org POC 请求...

WordPress Relevanssi plugin <= 4.28.1 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Mutantgun in WordPress Plugin Relevanssi versions = 4.28.1...

CVE-2026-19985

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.28.1 via the 's', 'posttypes', and 'orderby' request parameters. This is due to insufficient input sanitization and output escaping in the relevanssidebugarray...

CVE-2026-19985 Relevanssi <= 4.28.1 - Reflected Cross-Site Scripting

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.28.1 via the 's', 'posttypes', and 'orderby' request parameters. This is due to insufficient input sanitization and output escaping in the relevanssidebugarray...

EUVD-2026-75937

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.28.1 via the 's', 'posttypes', and 'orderby' request parameters. This is due to insufficient input sanitization and output escaping in the relevanssidebugarray...

CVE-2026-19985

Relevanssi – A Better Search (WordPress plugin) versions up to and including 4.28.1 are vulnerable to Reflected Cross-Site Scripting via the s, post_types, and orderby request parameters. The root cause is insufficient input sanitization and output escaping in the relevanssi_debug_array() functio...

CVE-2025-4396

CVE-2025-4396 — Relevanssi SQL Injection Time-Based Blind Disclaimer: This repository is intended for authorized penetration testing, security research, and educational purposes only. Unauthorized access to computer systems is illegal and unethical. Overview A proof-of-concept exploit for a...

EUVD-2026-53058

The plugin provides an Admin Search page that allows users with the editposts capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded args parameter, parses it into a WPQuery, and then passes user-controlled taxonomy query data into Relevanssi's...

CVE-2026-15941 Relevanssi <= 4.27.1 and Relevanssi Premium <= 2.30.2 - Authenticated (Contributor+) SQL Injection

The plugin provides an Admin Search page that allows users with the editposts capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded args parameter, parses it into a WPQuery, and then passes user-controlled taxonomy query data into Relevanssi's...

CVE-2026-15941

The CVE details a SQL injection in Relevanssi (WordPress plugin) versions up to 4.27.1 and Premium up to 2.30.2 via the Admin Search AJAX: an args parameter is parsed into WP_Query and used to build taxonomy restrictions, with taxonomy value sanitized as text but not parameterized for SQL before ...

CVE-2026-15941

The plugin provides an Admin Search page that allows users with the editposts capability to run Relevanssi searches from the WordPress dashboard. The AJAX handler accepts a URL-encoded args parameter, parses it into a WPQuery, and then passes user-controlled taxonomy query data into Relevanssi's...

WordPress Relevanssi – A Better Search plugin <= 4.27.1 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by daroo in WordPress Plugin Relevanssi versions = 4.27.1...

WordPress Relevanssi Premium – A Better Search plugin <= 2.30.2 - Authenticated (Contributor+) SQL Injection vulnerability

Authenticated Contributor+ SQL Injection vulnerability discovered by daroo in WordPress Plugin Relevanssi Premium versions = 2.30.2...

CVE-2026-59533

Unauthenticated SQL Injection in Relevanssi Light = 1.2.2 versions...

CVE-2026-59533

Unauthenticated SQL Injection in Relevanssi Light = 1.2.2 versions...

EUVD-2026-49209

Unauthenticated SQL Injection in Relevanssi Light = 1.2.2 versions...

CVE-2026-59533

The CVE concerns the WordPress Relevanssi Light plugin (versions &lt;= 1.2.2). It describes an unauthenticated SQL injection vulnerability in this plugin, with CVSS v3.1 indicating a CRITICAL base score (9.3) and HIGH confidentiality impact. The affected component is the Relevanssi Light plugin f...