Threats tagged 'ghsa-cqrq-24rf-5fg8'

The Relevanssi – A Better Search plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in all versions up to and including 4.28.5. This vulnerability arises from insufficient input sanitization and output escaping of the 'comment' parameter. Exploitation requires that the site has both comment indexing and comment highlighting enabled. An unauthenticated attacker can inject malicious scripts that execute when a user visits a singular page via a Relevanssi search-result permalink with the highlight query parameter.