CVE-2025-5016: medium-severity vulnerability in comesio Relevanssi – A Better Search
Relevanssi <= 4.24.5 (Free) and <= 2.27.6 (Premium) - Unauthenticated Stored Cross-Site Scripting via Excerpt Highlights
Published · Updated
35Vexday Risk Score
Prioritize patching. It exploitation observed by VulnCheck.
ssvc Attendcvss 4.7epss 0.2%
from disclosure to weapon
Published on NVDMay 31
VulnCheck+500d
exploitation probability
0.2%top 88% of all CVEs
observed exploitation
yesVulnCheck
The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Excerpt Highlights in all versions up to, and including, 4.24.5 (Free) and 2.27.6 (Premium) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Related CVEs — comesio Relevanssi – A Better Search
In the same product, most dangerous first.
CVE-2024-1380MEDIUMRelevanssi – A Better Search <= 4.22.0 (Free) and <= 2.25.0 (Premium) - Missing Authorization to Unauthenticated Query Log ExportEPSS 50.2%CVE-2025-4396HIGHRelevanssi <= 4.24.4 (Free) and <= 2.27.5 (Premium) - Unauthenticated SQL InjectionEPSS 2.7%CVE-2024-3213MEDIUMRelevanssi – A Better Search <= 4.22.1 - Missing Authorization to Unauthenticated Count Option UpdateEPSS 0.8%CVE-2024-3214MEDIUMRelevanssi – A Better Search <= 4.22.1 - Unauthenticated Second Order CSV InjectionEPSS 0.8%CVE-2024-7630MEDIUMRelevanssi <= 4.22.2 (Free) and <= 2.25.1 (Premium) - Unauthenticated Information ExposureEPSS 0.5%CVE-2026-15941MEDIUMRelevanssi <= 4.27.1 and Relevanssi Premium <= 2.30.2 - Authenticated (Contributor+) SQL InjectionEPSS 0.4%