Relevanssi vulnerabilities

The Relevanssi plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in versions up to 4.28.5 due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts that execute when a user visits an injected page. This requires comment indexing and highlighting enabled, and the payload fires when a visitor reaches a singular page via a Relevanssi search-result permalink with the highlight query parameter.

The Relevanssi plugin for WordPress (versions up to 4.28.4) contains a deserialization of untrusted data vulnerability that allows object injection. The issue affects versions from n/a through 4.28.4.

The Relevanssi plugin provides an Admin Search page that allows users with the `edit_posts` capability to run searches. The AJAX handler parses a user-controlled `args` parameter and passes taxonomy data to the restriction builder, where the value is not parameterized before being interpolated into a SQL query. This allows an authenticated contributor-level attacker to perform time-based blind SQL injection.