CVE-2026-114704
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk35th percentile - higher than 35% of all known CVEs
Summary
The Relevanssi plugin for WordPress (versions up to 4.28.4) contains a deserialization of untrusted data vulnerability that allows object injection. The issue affects versions from n/a through 4.28.4.
Risk Assessment
An attacker could exploit object injection to perform unauthorized actions within the WordPress application context. This may lead to site compromise or data leakage.
Recommendation
Update the Relevanssi plugin to a version later than 4.28.4. Until then, consider disabling or restricting access to the plugin.
Other vulnerabilities in Relevanssi
See all- CVE-2026-116522High
The Relevanssi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in versions up to 4.28.5 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user visits an injected page. This requires comment indexing and highlighting enabled, and the payload fires when a visitor reaches a singular page via a Relevanssi search-result permalink with the highlight query parameter.
- CVE-2026-15941Medium
The Relevanssi plugin provides an Admin Search page that allows users with the `edit_posts` capability to run searches. The AJAX handler parses a user-controlled `args` parameter and passes taxonomy data to the restriction builder, where the value is not parameterized before being interpolated into a SQL query. This allows an authenticated contributor-level attacker to perform time-based blind SQL injection.
Original NVD description (English source)
Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS