CVE-2025-5016

Executive Summary

CVE-2025-5016 is a Stored Cross-Site Scripting (XSS) vulnerability in the Relevanssi – A Better Search plugin for WordPress. The flaw exists in the Excerpt Highlights feature, where insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts. These scripts execute whenever a user accesses a page containing the malicious payload. The vulnerability affects all versions up to and including 4.24.5 (Free) and 2.27.6 (Premium). With a CVSS score of 4.7 (Medium), the risk is elevated due to the lack of authentication required for exploitation and the potential for widespread impact across WordPress sites using this plugin.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The Relevanssi plugin is distributed via the official WordPress plugin repository and premium channels. Users are advised to monitor for official patches and verify plugin integrity via checksums. No known supply chain compromise has been reported, but the unpatched status increases risk for sites relying on this plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 4.7 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must view the page)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is medium due to the low complexity and no authentication requirement, but user interaction is needed for script execution.

Deep Dive & Mechanics

The vulnerability resides in the Excerpt Highlights feature of Relevanssi. When search results are displayed, the plugin highlights matching terms in excerpts. The flaw occurs because user-supplied input (e.g., search queries) is not properly sanitized before being reflected in the excerpt output. An attacker can craft a search query containing malicious JavaScript, which is then stored in the excerpt field of a post or page. When other users view that page, the script executes in their browser context.

The root cause is insufficient input sanitization and output escaping in the excerpt highlighting logic. The plugin fails to escape HTML entities or strip script tags from the highlighted terms, allowing arbitrary script injection.

Vulnerable vs. Patched Code

Vulnerable Code (Excerpt Highlighting):

function relevanssi_highlight_excerpt($excerpt, $query) {
    $highlighted = str_ireplace($query, '<span class="relevanssi-highlight">' . $query . '</span>', $excerpt);
    return $highlighted;
}

This code directly inserts the user query into the HTML without escaping, leading to XSS.

Patched Code (Expected Fix):

function relevanssi_highlight_excerpt($excerpt, $query) {
    $escaped_query = esc_html($query);
    $highlighted = str_ireplace($escaped_query, '<span class="relevanssi-highlight">' . $escaped_query . '</span>', $excerpt);
    return $highlighted;
}

The patched version uses esc_html() to escape the query before insertion, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with Relevanssi plugin (Free <= 4.24.5 or Premium <= 2.27.6)
• Ability to submit search queries (no authentication required)

Exploitation Steps:

1. Identify a target WordPress site using Relevanssi.
2. Craft a malicious search query containing XSS payload, e.g.:

   <script>alert('XSS')</script>
   

3. Submit the query via the search form. The plugin will store the query in the excerpt of a search result page.
4. When an administrator or other user views the search results page, the script executes.

Proof-of-Concept (PoC) Code:

<!-- Submit via search form -->
<form action="http://target-site.com/" method="get">
    <input type="text" name="s" value="<script>alert('XSS')</script>">
    <input type="submit">
</form>

Blue Team

Detection:

• Monitor for unusual search queries containing script tags or event handlers.
• Use WAF rules to block common XSS patterns in search parameters.

Hunting:

• Search WordPress database for stored XSS payloads in post excerpts.
• Review server logs for requests with s parameter containing <script> or onerror=.

Indicators of Compromise (IOCs)

• Network: HTTP GET requests with s parameter containing <script> tags.
• Host: WordPress database entries in wp_posts or wp_postmeta with malicious JavaScript in excerpt fields.
• File: Modified plugin files (though unlikely, check for backdoors).
• Logs: Access logs showing repeated search queries with XSS patterns.

Detection Engineering

YARA Rule

rule CVE_2025_5016_Relevanssi_XSS {
    meta:
        description = "Detects Relevanssi plugin files vulnerable to stored XSS"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-5016"
    strings:
        $vuln_func = "relevanssi_highlight_excerpt"
        $unsafe_replace = "str_ireplace" nocase
        $no_escape = "esc_html" nocase
    condition:
        $vuln_func and $unsafe_replace and not $no_escape
}

Sigma Rule

title: Relevanssi Stored XSS Detection
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential exploitation of CVE-2025-5016 via search queries
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - '<script>'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of script tags in search (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-5016 Relevanssi Stored XSS Attempt"; flow:to_server,established; content:"GET"; http_method; content:"s="; http_uri; pcre:"/<script[^>]*>/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Excerpt Highlights feature in Relevanssi settings until a patch is applied.
2. Implement a Web Application Firewall (WAF) rule to block XSS payloads in search parameters.
3. Restrict search functionality to authenticated users if possible.

Long-term Fix:

• Apply the official patch from Relevanssi when released (monitor plugin updates).
• Upgrade to a patched version (Free > 4.24.5 or Premium > 2.27.6).
• Conduct a security audit of all WordPress plugins for similar vulnerabilities.

Workaround:

• Use a security plugin like Wordfence to add input sanitization for search queries.
• Manually edit the plugin file to add esc_html() around the query variable (not recommended for non-developers).

Valters IT
Securing Digital Frontiers