CVE-2026-19985 is a reflected cross-site scripting vulnerability in the Relevanssi – A Better Search WordPress plugin affecting versions up to 4.28.1. The flaw exists in the relevanssi_debug_array() function in lib/debug.php, which prints user-supplied query parameters ('s', 'post_types', 'orderby') inside a <pre> block without proper HTML escaping. The debug output is enabled by the relevanssi_debug=on request parameter when the administrator has enabled debugging mode. The debug gate lacks nonce verification, capability checks, or login requirements, enabling unauthenticated attackers to inject arbitrary scripts that execute in the context of users who visit a crafted URL.

An unauthenticated attacker can exploit this vulnerability to conduct reflected cross-site scripting attacks by tricking users into clicking malicious links. Successful exploitation can lead to the execution of arbitrary scripts in the victim's browser, potentially resulting in information disclosure, session hijacking, or other client-side impacts. The CVSS 3.1 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact.

No patch or official fix is currently indicated in the provided data. Administrators should disable debugging mode in the Relevanssi plugin to prevent exposure of the vulnerable debug output. Avoid enabling the relevanssi_debug=on parameter on production sites or restrict access to trusted users only. Monitor vendor advisories for updates or patches addressing this vulnerability.