Relevanssi <= 4.28.3 - Unauthenticated Stored Cross-Site Scripting via Comment Content

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-97641 · Microsoft / collected KEV context

cve-program · CVE-2026-97641

• https://www.wordfence.com/threat-intel/vulnerabilities/id/47751ff1-2f22-4335-8e75-7ff1b6214426?source=cve
• https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.28.3/lib/excerpts-highlights.php#L883
• https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.28.3/lib/excerpts-highlights.php#L421
• https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.28.3/lib/excerpts-highlights.php#L216
• https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.28.3/lib/admin-ajax.php#L492
• https://plugins.trac.wordpress.org/browser/relevanssi/tags/4.28.3/lib/indexing.php#L1067
• https://github.com/msaari/relevanssi/commit/3dddec3416fbda298e18649127f31557398d10b0

No related operational record is retained in the current change model.