The Relevanssi WordPress plugin versions up to 4.24.3 (free) and 2.27.4 (premium) contain a stored cross-site scripting vulnerability (CWE-79) in the highlights feature. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts due to improper neutralization of input during web page generation, specifically insufficient input sanitization and output escaping. When a user accesses a search result page containing the injected script, the malicious code executes in the user's browser context. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity but no impact on availability. No patch or remediation details are currently provided by the vendor, and no known exploits have been reported.

Successful exploitation allows unauthenticated attackers to perform stored cross-site scripting attacks, potentially leading to the execution of arbitrary scripts in the context of users visiting affected search result pages. This can result in limited confidentiality and integrity impacts, such as session hijacking or content manipulation. There is no reported impact on availability. The vulnerability affects all users of the vulnerable plugin versions who access injected pages.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the highlights functionality or the Relevanssi plugin if feasible to mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.