CVE-2026-97641 is a stored cross-site scripting vulnerability (CWE-79) in the Relevanssi – A Better Search plugin for WordPress. The flaw exists due to improper neutralization of input during web page generation, specifically in comment content handling. Versions up to and including 4.28.3 are affected. The vulnerability is exploitable only if the administrator has set a non-empty "Allowable tags in excerpts" configuration, such as the default example tags (<p><a><strong>), because the prefix-matching regex used for tag validation allows injection of tags whose names are prefixes of allowed tags. This enables unauthenticated attackers to inject malicious scripts that execute in the context of users visiting the injected pages.

Successful exploitation allows unauthenticated attackers to perform stored cross-site scripting attacks, potentially leading to the execution of arbitrary scripts in the context of users visiting affected pages. This can result in information disclosure and limited integrity impact. The CVSS 3.1 base score is 7.2 (high severity), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impact on confidentiality and integrity but not availability.

No official patch or fix is currently documented in the provided data. Users should check the vendor advisory for updates. Until a fix is available, administrators should consider setting the "Allowable tags in excerpts" setting to an empty value to prevent exploitation. Monitoring vendor communications for an official fix is recommended.