CVE-2026-19985: Relevanssi <= 4.28.1 - Reflected Cross-Site Scripting
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 4.28.1 via the 's', 'posttypes', and 'orderby' request parameters. This is due to insufficient input sanitization and output escaping in the relevanssidebugarray() function in lib/debug.php, which dumps user-supplied query variables through printr() inside a <pre> block without HTML escaping. The debug path is enabled by supplying the relevanssidebug=on request parameter when the administrator has previously enabled the 'Debugging mode' setting; the gate itself is a configuration check with no capability, nonce, or logged-in check (the vendor explicitly suppresses nonce verification on that line). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/relevanssito a version that resolves this vulnerability.Fixed in 4.28.1 - Configuration
Disable the Relevanssi 'Debugging mode' setting so that the relevanssi_debug=on request parameter cannot enable the vulnerable debug path.
Relevanssi WordPress plugin (Debugging mode setting) Debugging mode = disable - Configuration
In relevanssi_debug_array() (lib/debug.php), replace print_r() output inside the <pre> block with HTML-escaped output to prevent reflected XSS via 's', 'post_types', and 'orderby' request parameters.
Relevanssi WordPress plugin (relevanssi_debug_array in lib/debug.php) output escaping for debug dumps = HTML-escape user-supplied query variables - Compensating control
Apply compensating web-layer protections (e.g., WAF/filters) to block or sanitize requests containing relevanssi_debug=on and the affected parameters ('s', 'post_types', 'orderby') until the plugin is remediated.
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
Affected installations are versions up to and including 4.28.1 where the administrator has enabled the plugin's “Debugging mode” setting. The vulnerable debug path is then activated through the relevanssi_debug=on request parameter.
What does an attacker need to exploit this issue?
An attacker does not need to be authenticated and does not need a capability or nonce. They must convince a user to visit or otherwise trigger a specially crafted request containing the debug parameter and malicious values in s, post_types, or orderby.
What can be done if updating is not immediately possible?
Disable the plugin's “Debugging mode” setting. The described vulnerable output path requires that setting to have been enabled by an administrator.
How can I determine whether my site is affected?
Check whether the installed Relevanssi version is 4.28.1 or earlier and review whether “Debugging mode” is enabled. Sites meeting both conditions can expose the debug output when a request includes relevanssi_debug=on.