# CVE-2026-116522: Relevanssi , A Better Search stored XSS via comment highlighting

Source: https://junglewise.ai/threats/cve-2026-116522-the-relevanssi-a-better-search-plugin-for-wordpress-is  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-31. Updated: 2026-10-31  
License: CC BY 4.0 with a link back

CVE-2026-116522 · Severity: high · CVSS 7.2 · Published 2026-10-31

Relevanssi is a WordPress search plugin that improves site search functionality. The plugin is vulnerable to stored cross-site scripting (XSS) attacks through comment highlighting, allowing unauthenticated attackers to inject malicious scripts that execute when users view search results. The attack requires the site to have both comment indexing and highlighting enabled, and the payload triggers when visitors reach a page through a Relevanssi search result with a highlight parameter.

Technologies: [Relevanssi – A Better Search](https://junglewise.ai/threats/technologies/a-better-search). Vendors: [Relevanssi](https://junglewise.ai/threats/vendors/relevanssi).

## Quick answers

**Is CVE-2026-116522 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116522 being exploited in the wild.

**How severe is CVE-2026-116522?** High severity, with a CVSS score of 7.2, published 31 October 2026.

**Which products and versions are affected?** Relevanssi – A Better Search up to and including 4.28.5.

**Is there a fix for CVE-2026-116522?** No fixed version is recorded yet. Disable the comment highlighting feature in Relevanssi settings until the plugin is updated to a patched version. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-116522 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-116522?** Check whether you run Relevanssi – A Better Search at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Disable the comment highlighting feature in Relevanssi settings until the plugin is updated to a patched version.

## Technical details

Stored XSS in the comment highlighting component due to insufficient input sanitization and output escaping of the 'comment' parameter. Unauthenticated attackers can inject arbitrary JavaScript that persists and executes in pages displayed via Relevanssi search-result permalinks. Exploitation requires both comment indexing and comment highlighting features to be enabled on the target WordPress site.

## Affected products

- Relevanssi Relevanssi – A Better Search up to and including 4.28.5

## Timeline

- 2026-10-31: disclosed

## References

- [https://github.com/msaari/relevanssi/commit/b0324957b27e2dfc2aa116c96dcf578fbec9e0e5](https://github.com/msaari/relevanssi/commit/b0324957b27e2dfc2aa116c96dcf578fbec9e0e5)
- [https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.28.5/lib/common.php](https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.28.5/lib/common.php)

## Related threats

- [Relevanssi , A Better Search stored XSS in comment content](https://junglewise.ai/threats/cve-2026-97641-the-relevanssi-a-better-search-plugin-for-wordpress-is-vulnerable)