CVE-2026-103426 is a stored cross-site scripting vulnerability in the Relevanssi Premium WordPress plugin affecting all versions up to 2.31.4. The vulnerability exists due to improper neutralization of input in the '_rt' parameter, which is not adequately sanitized or escaped before being included in web pages. This flaw allows unauthenticated attackers to inject malicious scripts that execute in the context of users visiting the injected pages. Exploitation requires the plugin's click-tracking and logging feature to be enabled and is simplified by the presence of a publicly emitted valid _rt_nonce token on search-results pages.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the browsers of users visiting affected pages, potentially leading to session hijacking, information disclosure, or other client-side impacts. The vulnerability has a CVSS v3.1 score of 7.2 (high severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity with scope change.

No official patch or fix is currently documented. Users should check the vendor advisory for updates. Until a fix is available, disabling the click-tracking and logging feature in the plugin settings will prevent exploitation. Monitoring vendor channels for a security update is recommended.