CVE-2026-103426

Executive Summary

CVE-2026-103426 is a stored cross-site scripting (XSS) vulnerability in the Relevanssi Premium plugin for WordPress, affecting all versions up to and including 2.31.4. The flaw resides in insufficient input sanitization and output escaping of the _rt parameter, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a victim accesses an injected page. Because the required _rt_nonce value is emitted publicly on every search-results page, exploitation requires no authentication and no privileged position, making this a trivially accessible injection vector against any target site that has enabled the plugin's click-tracking and logging feature.

Technical Analysis

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e., cross-site scripting) and carries a CVSS 3.1 base score of 7.2. The mechanism is a classic stored (persistent) XSS condition: the plugin accepts data through the _rt parameter, fails to sanitize that input on ingestion and/or fails to escape it on output, and subsequently renders the unsanitized value inside an HTML response context.

Two conditions define the attack surface. First, the click-tracking and logging feature must be activated in the plugin settings — without it, the vulnerable code path is not reachable. Second, the _rt parameter must be accepted by the plugin and persisted or reflected into a page later rendered to a user. The NVD description states the injection is possible because the _rt parameter is handled with "insufficient input sanitization and output escaping." In practical terms, this means whatever data arrives via _rt is neither validated against a strict allow-list nor contextually escaped when written back into the HTML document. An attacker who supplies markup through _rt therefore causes the browser to parse and execute that markup as part of the page.

Notably, the CVSS vector includes S:C (Scope Changed), indicating that the vulnerable component's security authority can be bypassed such that the successful exploit impacts resources beyond the component's original security scope. In a WordPress context this reflects the fact that injected script runs in the origin's context, giving it access to the same-origin document object model, session cookies not marked HttpOnly, and authenticated administrative interfaces. The PR:N and UI:N metrics confirm that no privileges are needed to inject and, per the vector, no user interaction is modeled beyond the victim loading the affected page — an important nuance, since the execution still requires a browser to render the injected content.

The decisive weakness that elevates this from a theoretically constrained XSS to a practical mass-exploitable issue is the nonce handling: a valid _rt_nonce is publicly emitted on every search-results page. WordPress nonces are intended to bind a request to an authenticated user session and to prevent CSRF-style abuse. Here, the token is exposed to unauthenticated visitors as part of ordinary page output, so it provides no meaningful protection against an anonymous attacker. The attacker can scrape the search-results page for a fresh _rt_nonce and then submit the _rt payload with a token that the plugin will accept. This effectively reduces the barrier to exploitation to zero — no account, no credential, no valid session, and no social engineering required to obtain the token.

Because the injected content is stored, the malicious script persists in the application and is served to every subsequent visitor of the injected page. There is no public proof-of-concept, exploit code, or Nuclei template available, and no patch evidence exists from any tracked source; patch confidence is 0/4 and the product is considered unpatched.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred from the vulnerability class (stored XSS via a publicly disclosed nonce) as described by the NVD entry.

1. Reconnaissance and target identification. An attacker enumerates Internet-facing WordPress installations and fingerprints the Relevanssi plugin. The presence of plugin-specific markup or resources on the site is sufficient to identify an installation. The attacker then confirms the click-tracking and logging feature is active, since the vulnerability is only reachable when that feature is enabled. A simple search query against the site (producing search-results output) serves as the confirmation step, because that is where the _rt_nonce is emitted.

2. Nonce harvesting. The attacker loads a search-results page and extracts the publicly emitted _rt_nonce value. Because the nonce is served to unauthenticated visitors, this step requires no account and no privileged access.

3. Payload injection. Using the harvested _rt_nonce, the attacker issues a request carrying the _rt parameter populated with arbitrary script content. The plugin performs insufficient input sanitization, so the payload is accepted and stored. At this stage the attacker has satisfied both prerequisites — a valid nonce and a reachable code path — and has written a persistent payload into the application.

4. Execution. The stored payload is written into a page without adequate output escaping. When any user subsequently accesses that injected page, the browser parses the injected script as part of the document and executes it in the origin's context. This is the point at which the CVSS "Scope Changed" condition materializes: the script operates with the authority of the vulnerable site's origin.

5. Post-exploitation impact. Because execution occurs same-origin, the attacker's script can read and manipulate the document, act on behalf of the victimized browser session, capture data rendered on the injected page, and redirect or overlay content to deceive users. If an administrative user views the injected page while authenticated, the script runs in the context of the administrative session — the classic privilege-escalation path for WordPress XSS, where injected JavaScript can perform authenticated administrative actions. The low integrity and confidentiality impacts (I:L, C:L) in the CVSS vector reflect that the immediate exploit does not by itself guarantee full data exfiltration or full application takeover, but the scope change means the blast radius extends beyond the plugin itself.

The attack is unauthenticated end-to-end (PR:N) and the vector carries UI:N, underscoring how little friction the publicly emitted nonce introduces. In practice the only "work" required of the attacker is harvesting a token that the site gives away freely.

Impact Assessment

The affected systems are WordPress sites running Relevanssi Premium at version 2.31.4 or earlier with the click-tracking and logging feature enabled. Because the injection is persistent and served on subsequent page loads, the blast radius is every visitor of an injected page, not merely the initial requestor. The CVSS subscores break down as follows:

• Confidentiality: Low (C:L). Injected scripts can access data available to the page and the browser session; the impact is constrained but real.
• Integrity: Low (I:L). Page content can be modified and stored payloads persist, altering the delivered application.
• Availability: None (A:N). No direct availability impact is modeled.
• Attack Vector: Network (AV:N). Exploitable remotely over the web.
• Attack Complexity: Low (AC:L). No special conditions beyond the feature being enabled and the nonce being publicly available.
• Privileges Required: None (PR:N). The publicly emitted _rt_nonce removes the authentication barrier entirely.
• User Interaction: None (UI:N). The vector models no required interaction, though execution in practice occurs when a browser renders the injected page.
• Scope: Changed (S:C). The exploited component can affect resources outside its original security authority — for WordPress, this means same-origin access to the broader site, including administrative sessions.

Business impact includes defacement of search or content pages, credential and session theft, drive-by redirects to malicious infrastructure, injection of unwanted content for SEO abuse, and — in the worst case — full site compromise when an administrator views an injected page while logged in. The stored nature of the flaw means remediation requires both patching and cleansing persisted payloads; removing the vulnerable code alone will not remove already-injected content.

Detection Guidance

Sigma Rule

title: Relevanssi Premium Stored XSS via _rt Parameter
id: 8f2a1c74-9b3e-4d51-a6c2-7e0f9d1b4a62
status: experimental
description: Detects HTTP requests supplying the _rt parameter with script-like content against WordPress Relevanssi Premium, indicative of CVE-2026-103426 exploitation.
author: valtersit.com
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_param:
    cs-uri-query|contains:
      - '_rt='
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - 'javascript:'
      - 'onerror='
      - 'onload='
      - '%3Cscript'
  condition: selection_param and selection_payload
fields:
  - c-ip
  - cs-uri-query
  - cs-user-agent
falsepositives:
  - Legitimate search queries containing the literal string '_rt='
  - Security scanners and fuzzing tools in non-production environments
level: high

YARA Rule

rule CVE_2026_103426_Relevanssi_RT_XSS
{
    meta:
        author = "valtersit.com"
        description = "Detects stored XSS payloads targeting the Relevanssi Premium _rt parameter (CVE-2026-103426)"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-103426"
        date = "2026-01-01"
        cve = "CVE-2026-103426"

    strings:
        $rt = "_rt=" ascii nocase
        $nonce = "_rt_nonce" ascii nocase
        $s1 = "<script" ascii nocase
        $s2 = "javascript:" ascii nocase
        $s3 = "onerror=" ascii nocase
        $s4 = "onload=" ascii nocase
        $s5 = "<svg" ascii nocase
        $s6 = "document.cookie" ascii nocase

    condition:
        ($rt or $nonce) and any of ($s*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-103426 Relevanssi Premium _rt Stored XSS Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"_rt="; nocase; http.uri; content:"<script"; nocase; distance:0; http.uri; content:"_rt="; nocase; http.uri; content:"<script"; nocase; http.uri; content:"onerror="; nocase; http.uri; content:"javascript:"; nocase; classtype:web-application-attack; reference:cve,2026-103426; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-103426; sid:2026103426; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where http.request.method == "GET"
      and http.request.uri contains "_rt="
      and http.request.uri contains "nonce" ]
  [ network where http.request.method == "GET"
      and http.request.uri contains "_rt="
      and (http.request.uri contains "<script"
           or http.request.uri contains "javascript:"
           or http.request.uri contains "onerror=") ]

Splunk SPL Query

index=web sourcetype=access_combined ("_rt=" AND ("<script" OR "javascript:" OR "onerror=" OR "onload=" OR "%3Cscript"))
| eval payload_indicators=mvcount(mvfilter(match(uri_query, "(?i)<script|javascript:|onerror=|onload=")))
| stats count values(uri_query) as queries values(user_agent) as agents by src_ip
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-103426">
  <rule id="1034261" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <url>_rt=</url>
    <regex type="pcre2">(?i)_rt=.*(%3[cC]script|<script|javascript:|onerror=|onload=)</regex>
    <description>CVE-2026-103426: Relevanssi Premium _rt stored XSS injection attempt detected</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>attack,xss,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source. There is no vendor fix and no tracked workaround. No fixed version is available.

1. Immediate mitigations

• If the click-tracking and logging feature is not essential, disable it in the Relevanssi Premium settings. The vulnerability is only reachable when this feature is activated; disabling it removes the attack surface.
• If the feature must remain enabled, consider temporarily removing or disabling the affected plugin until a fixed version is released.
• Deploy virtual patching at the WAF layer: block requests where the _rt parameter contains script-like sequences (<script, javascript:, event-handler attributes such as onerror=/onload=, encoded equivalents). Apply input validation that rejects markup in _rt rather than attempting output escaping.
• Constrain the exposure of the _rt_nonce. Because the token is publicly emitted on search-results pages, it provides no protection; treat any design that relies on it for unauthenticated requests as untrusted.

2. Patch/upgrade steps

• No patched release is currently available. Monitor the Relevanssi project's official release channel for an updated version addressing the _rt parameter handling, and apply it immediately upon release.
• Once a fix is released, purge stored payloads after upgrading. Removing the vulnerable code does not remove content already persisted by prior exploitation; previously injected pages must be identified and cleansed.

3. Long-term hardening

• Enforce context-aware output escaping and strict input sanitization/allow-listing across all plugin parameters, and validate that third-party plugins follow the same discipline.
• Treat nonces as CSRF protections, not authorization controls; never rely on a publicly emitted nonce to gate an unauthenticated action.
• Deploy server-side input validation and a Content Security Policy that limits inline script execution to reduce XSS impact.
• Maintain an inventory of installed plugins and their versions, and subscribe to vendor advisories so unpatched components are identified quickly.
• Continuously scan for and clean stored XSS payloads in persisted content, not just inbound requests.

References

• NVD — CVE-2026-103426: https://nvd.nist.gov/vuln/detail/CVE-2026-103426
• CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• Relevanssi (plugin project page and release notes): https://wordpress.org/plugins/relevanssi/
• WordPress Developer Reference — Nonces: https://developer.wordpress.org/apis/security/nonces/
• OWASP — Cross Site Scripting Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html

No exploit code, public PoC, or Nuclear template exists for this CVE. There is no evidence of exploitation in the wild, and the CVE is not listed in CISA's Known Exploited Vulnerabilities catalog. No threat actor campaigns have been attributed.