CVE-2026-19985 (GCVE-0-2026-19985)
Vulnerability from cvelistv5
Published
2026-09-11 03:39
Modified
2026-09-11 14:10
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Summary
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.28.1 via the 's', 'post_types', and 'orderby' request parameters. This is due to insufficient input sanitization and output escaping in the relevanssi_debug_array() function in lib/debug.php, which dumps user-supplied query variables through print_r() inside a <pre> block without HTML escaping. The debug path is enabled by supplying the relevanssi_debug=on request parameter when the administrator has previously enabled the 'Debugging mode' setting; the gate itself is a configuration check with no capability, nonce, or logged-in check (the vendor explicitly suppresses nonce verification on that line). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
References
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| comesio | Relevanssi – A Better Search |
Version: 0 ≤ 4.28.1 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-19985",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-11T14:09:50.573564Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T14:10:13.313Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Relevanssi \u2013 A Better Search",
"vendor": "comesio",
"versions": [
{
"lessThanOrEqual": "4.28.1",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Mutantgun"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Relevanssi \u2013 A Better Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.28.1 via the \u0027s\u0027, \u0027post_types\u0027, and \u0027orderby\u0027 request parameters. This is due to insufficient input sanitization and output escaping in the relevanssi_debug_array() function in lib/debug.php, which dumps user-supplied query variables through print_r() inside a \u003cpre\u003e block without HTML escaping. The debug path is enabled by supplying the relevanssi_debug=on request parameter when the administrator has previously enabled the \u0027Debugging mode\u0027 setting; the gate itself is a configuration check with no capability, nonce, or logged-in check (the vendor explicitly suppresses nonce verification on that line). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-11T03:39:38.495Z",
"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"shortName": "Wordfence"
},
"references": [
{
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d07fe28c-f76e-42b2-b894-be316004235a?source=cve"
},
{
"url": "https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.27.2/lib/search.php#L132"
},
{
"url": "https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.27.2/lib/search.php#L143"
},
{
"url": "https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.28.1/lib/debug.php#L68"
},
{
"url": "https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.28.1/lib/search.php#L132"
},
{
"url": "https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.28.1/lib/search.php#L143"
},
{
"url": "https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.28.1/lib/debug.php#L27"
},
{
"url": "https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.28.1/lib/search.php#L562"
},
{
"url": "https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.27.2/lib/debug.php#L68"
},
{
"url": "https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.27.2/lib/debug.php#L27"
},
{
"url": "https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.27.2/lib/search.php#L562"
},
{
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3650355%40relevanssi%2Ftrunk\u0026old=3529670%40relevanssi%2Ftrunk\u0026sfp_email=\u0026sfph_mail="
}
],
"timeline": [
{
"lang": "en",
"time": "2026-08-16T14:08:59.000Z",
"value": "Vendor Notified"
},
{
"lang": "en",
"time": "2026-09-10T14:41:38.000Z",
"value": "Disclosed"
}
],
"title": "Relevanssi \u003c= 4.28.1 - Reflected Cross-Site Scripting"
}
},
"cveMetadata": {
"assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
"assignerShortName": "Wordfence",
"cveId": "CVE-2026-19985",
"datePublished": "2026-09-11T03:39:38.495Z",
"dateReserved": "2026-08-16T13:53:20.548Z",
"dateUpdated": "2026-09-11T14:10:13.313Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-19985\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-11T14:09:50.573564Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-11T14:10:03.202Z\"}}], \"cna\": {\"title\": \"Relevanssi \u003c= 4.28.1 - Reflected Cross-Site Scripting\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Mutantgun\"}], \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 6.1, \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\"}}], \"affected\": [{\"vendor\": \"comesio\", \"product\": \"Relevanssi \\u2013 A Better Search\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"4.28.1\"}], \"defaultStatus\": \"unaffected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-08-16T14:08:59.000Z\", \"value\": \"Vendor Notified\"}, {\"lang\": \"en\", \"time\": \"2026-09-10T14:41:38.000Z\", \"value\": \"Disclosed\"}], \"references\": [{\"url\": \"https://www.wordfence.com/threat-intel/vulnerabilities/id/d07fe28c-f76e-42b2-b894-be316004235a?source=cve\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.27.2/lib/search.php#L132\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.27.2/lib/search.php#L143\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.28.1/lib/debug.php#L68\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.28.1/lib/search.php#L132\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.28.1/lib/search.php#L143\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.28.1/lib/debug.php#L27\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.28.1/lib/search.php#L562\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.27.2/lib/debug.php#L68\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.27.2/lib/debug.php#L27\"}, {\"url\": \"https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.27.2/lib/search.php#L562\"}, {\"url\": \"https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026new=3650355%40relevanssi%2Ftrunk\u0026old=3529670%40relevanssi%2Ftrunk\u0026sfp_email=\u0026sfph_mail=\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"The Relevanssi \\u2013 A Better Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.28.1 via the \u0027s\u0027, \u0027post_types\u0027, and \u0027orderby\u0027 request parameters. This is due to insufficient input sanitization and output escaping in the relevanssi_debug_array() function in lib/debug.php, which dumps user-supplied query variables through print_r() inside a \u003cpre\u003e block without HTML escaping. The debug path is enabled by supplying the relevanssi_debug=on request parameter when the administrator has previously enabled the \u0027Debugging mode\u0027 setting; the gate itself is a configuration check with no capability, nonce, or logged-in check (the vendor explicitly suppresses nonce verification on that line). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-79\", \"description\": \"CWE-79 Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)\"}]}], \"providerMetadata\": {\"orgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"shortName\": \"Wordfence\", \"dateUpdated\": \"2026-09-11T03:39:38.495Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-19985\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-11T14:10:13.313Z\", \"dateReserved\": \"2026-08-16T13:53:20.548Z\", \"assignerOrgId\": \"b15e7b5b-3da4-40ae-a43c-f7aa60e62599\", \"datePublished\": \"2026-09-11T03:39:38.495Z\", \"assignerShortName\": \"Wordfence\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…