CVE-2026-19985
Received Received - Intake

Reflected XSS in Relevanssi WordPress Plugin

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: Wordfence

Description
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.28.1 via the 's', 'post_types', and 'orderby' request parameters. This is due to insufficient input sanitization and output escaping in the relevanssi_debug_array() function in lib/debug.php, which dumps user-supplied query variables through print_r() inside a <pre> block without HTML escaping. The debug path is enabled by supplying the relevanssi_debug=on request parameter when the administrator has previously enabled the 'Debugging mode' setting; the gate itself is a configuration check with no capability, nonce, or logged-in check (the vendor explicitly suppresses nonce verification on that line). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-19985
EUVD
EUVD-2026-75937

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
relevanssi relevanssi to 4.28.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Reflected Cross-Site Scripting (XSS) issue in the Relevanssi WordPress plugin up to version 4.28.1. It occurs because user-supplied input in parameters like 's', 'post_types', and 'orderby' is not properly sanitized or escaped before being output in a debug function. Attackers can exploit this by tricking users into clicking a malicious link, which executes arbitrary scripts in their browser.

Detection Guidance

Check if the Relevanssi plugin is installed and its version is up to 4.28.1. Enable debugging mode in the plugin settings and inspect requests containing the 's', 'post_types', or 'orderby' parameters with the 'relevanssi_debug=on' flag. Look for reflected input in responses.

Impact Analysis

An attacker could steal sensitive user data like cookies or session tokens, perform actions on behalf of the user, or deface websites. Since the attack is reflected, it requires user interaction, such as clicking a crafted link. The impact depends on user privileges and the site's configuration.

Compliance Impact

This XSS vulnerability could lead to unauthorized access to personal data, violating GDPR's data protection principles. For HIPAA, it may compromise protected health information if exploited. Both standards require safeguards against unauthorized data access, which this flaw undermines.

Mitigation Strategies

Update the Relevanssi plugin to the latest version. Disable debugging mode in the plugin settings. Implement input sanitization for user-supplied parameters. Monitor for unusual activity or unauthorized script execution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19985. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart