The Relevanssi plugin for WordPress suffers from a stored cross-site scripting vulnerability (CWE-79) due to improper neutralization of input during web page generation. Specifically, the Excerpt Highlights feature does not adequately sanitize or escape user input, enabling unauthenticated attackers to inject arbitrary scripts. These scripts execute in the context of users who access the compromised pages, potentially leading to information disclosure or session hijacking. The vulnerability affects all versions up to 4.24.5 (Free) and 2.27.6 (Premium). The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

An unauthenticated attacker can inject persistent malicious scripts into pages generated by the Relevanssi plugin's Excerpt Highlights feature. When other users view these pages, the scripts execute in their browsers, potentially leading to information disclosure or manipulation of user sessions. The impact is limited to confidentiality and integrity with low severity, and no impact on availability is noted. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the Excerpt Highlights feature or applying custom input sanitization and output escaping as a temporary mitigation. Monitor official Relevanssi communications for updates and apply patches promptly once released.