CVE-2026-97641

Executive Summary

CVE-2026-97641 is a stored cross-site scripting (XSS) vulnerability in the Relevanssi – A Better Search plugin for WordPress, affecting all versions up to and including 4.28.3. The flaw arises from insufficient input sanitization and output escaping of comment content, allowing unauthenticated attackers to inject arbitrary web scripts that execute when a user views an injected page. Exploitation requires the administrator to have configured a non-empty value for the "Allowable tags in excerpts" setting, since the prefix-matching regex must contain an allowable tag whose name is a prefix of the injected tag name.

Technical Analysis

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, i.e., Cross-Site Scripting) and carries a CVSS v3.1 base score of 7.2 (High). The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N indicates a network-reachable, low-complexity attack requiring no privileges and no user interaction on the attacker's part. The scope change (S:C) reflects that the vulnerable component (Relevanssi) impacts resources beyond its own security authority (the broader WordPress site), while confidentiality and integrity impacts are low and availability impact is none.

Per the NVD description, the root cause is a combination of insufficient input sanitization and insufficient output escaping applied to comment content. Comment content is a standard, low-privilege input vector in WordPress; unauthenticated visitors can typically submit comments unless the site disables comments or enforces strict moderation. Because the plugin processes this content in the context of its search and excerpt functionality, malicious markup supplied in a comment can be stored and later rendered in a page without proper encoding.

The exploitation precondition is specific and notable: the administrator must have configured a non-empty value for the "Allowable tags in excerpts" setting, such as the default example value of <p><a><strong>. The NVD description further explains that the prefix-matching regex must have an allowable tag whose name is a prefix of the injected tag name. In other words, the plugin applies a regex-based filter to permit only a limited set of HTML tags in excerpts. Because the matching logic is prefix-based rather than anchored/full-tag matching, an injected tag whose name begins with an allowed tag name can slip past the filter. This is a classic filter-bypass pattern: allowlist matching implemented with a prefix rather than a strict boundary check. The description does not reveal the exact regex, function names, or parameter names involved, so the precise code path cannot be specified without speculation.

The attack surface is the public-facing comment submission and search/excerpt rendering pipeline of a WordPress site running the affected plugin. Any page that renders Relevanssi-generated excerpts containing the stored comment content is a potential execution context for the injected script.

Exploitation Scenarios

No public PoC or exploit code is available for CVE-2026-97641; the attack chain below is inferred from the vulnerability class (stored XSS via filter bypass) and constrained strictly to details present in the NVD description.

1. Reconnaissance / target identification: An attacker identifies a WordPress site using the Relevanssi – A Better Search plugin, version 4.28.3 or earlier. Public fingerprinting can be performed via plugin assets referenced in the site's HTML, such as paths under the plugin directory. The attacker also needs to determine whether comments are enabled and, ideally, whether the "Allowable tags in excerpts" setting is non-empty. The latter may not be directly observable externally, but the default example value (<p><a><strong>) is common, and the attacker can attempt the technique regardless.

2. Triggering the flaw: The attacker submits a comment containing crafted content designed to survive the plugin's excerpt tag filtering. The NVD description specifies the mechanism: the prefix-matching regex must contain an allowable tag whose name is a prefix of the injected tag name. For example, if <p>, <a>, and <strong> are allowable, an injected tag whose name begins with one of those strings would be required for the bypass to occur. Because the description does not identify the exact malicious tag used, the precise payload cannot be stated. The core action is unauthorized injection of script-capable markup into comment content that is later incorporated into a Relevanssi-generated excerpt.

3. Execution: When a user — for example an administrator or any visitor — accesses a page where the stored comment content is rendered in an excerpt, the injected web script executes in the context of the victim's browser session (stored XSS). The CVSS vector reflects network attack vector, no privileges required, and no user interaction for the attacker, though the victim must view the injected page for the script to execute.

4. Post-exploitation impact: Because the script executes in the origin of the vulnerable WordPress site, the attacker can act with the victim's session privileges. Typical stored-XSS outcomes include session/token theft, forced actions under the victim's identity, credential harvesting via injected forms, and redirection to malicious content. The scope-change metric (S:C) reflects that impact can extend to the broader site and its users, not just the plugin component. Confidentiality and integrity impacts are rated Low, and availability impact is None.

Impact Assessment

Successful exploitation allows unauthenticated attackers to persistently inject and execute arbitrary web scripts in pages served by affected WordPress sites. Given that comment submission is frequently open to anonymous users, the barrier to entry is low. The CVSS base score of 7.2 (High) with scope change (S:C) indicates a meaningful risk: attacker-controlled code can affect components beyond the vulnerable plugin, including other site functionality and authenticated user sessions.

The most severe scenario is compromise of an administrator session, particularly if the malicious comment is rendered in an administrative context or on a page an admin routinely visits. This can lead to full site takeover, content manipulation, or installation of additional malicious plugins/themes. Other site visitors are also at risk of script execution, enabling phishing overlays, credential theft, and malware distribution.

Business impact includes reputational damage, loss of customer trust, potential data exposure through session hijacking, and follow-on compromise of connected systems. The blast radius is the entire affected WordPress installation and any users who view pages containing the injected content. The precondition — a non-empty "Allowable tags in excerpts" setting — is a configuration-dependent limiter; sites with this setting empty are not exploitable per the description.

The lack of an EPSS score (not yet scored by FIRST.org) means no probabilistic exploitation forecast is available, and absence from CISA KEV indicates no confirmed in-the-wild exploitation has been catalogued by CISA at this time. Patch confidence is 0/4: no vendor patch or tracked fix source is available.

Detection Guidance

Sigma Rule

title: Relevanssi Plugin Stored XSS via Comment Content (CVE-2026-97641)
id: 7f3c9a2e-1b64-4d8a-9c07-5e2f1a8b0d31
status: experimental
description: Detects attempts to store script-capable markup in WordPress comment content targeting the Relevanssi plugin excerpt tag filter bypass.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-97641
author: Threat Intelligence
logsource:
  product: wordpress
  service: access
detection:
  selection_method:
    cs-method:
      - POST
  selection_endpoint:
    cs-uri-query|contains:
      - 'wp-comments-post.php'
  selection_payload:
    cs-body|contains:
      - '<script'
      - 'onerror='
      - 'onload='
      - 'javascript:'
  condition: selection_method and selection_endpoint and selection_payload
falsepositives:
  - Legitimate comments containing encoded code samples
  - Security scanners and vulnerability assessment tools
level: high
tags:
  - attack.t1190
  - cwe.79

YARA Rule

rule CVE_2026_97641_Relevanssi_Stored_XSS
{
    meta:
        description = "Detects script-capable markup consistent with Relevanssi comment-content stored XSS (CVE-2026-97641)"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97641"
        date = "2026-01-01"
        severity = "high"

    strings:
        $plugin = "relevanssi" ascii nocase
        $comment = "comment_content" ascii nocase
        $tag1 = "<script" ascii nocase
        $tag2 = "javascript:" ascii nocase
        $tag3 = "onerror=" ascii nocase
        $tag4 = "onload=" ascii nocase
        $allow = "allowable tags in excerpts" ascii nocase

    condition:
        $plugin and $comment and any of ($tag*) or ($plugin and $allow and any of ($tag*))
}

Suricata IDS Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-97641 Relevanssi Plugin Stored XSS via Comment Content"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"wp-comments-post.php"; http.request_body; content:"<script"; nocase; http.request_body; content:"onerror="; nocase; reference:cve,2026-97641; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-97641; classtype:web-application-attack; sid:202697641; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where network.protocol == "http" and http.request.method == "POST" and
    url.path contains "wp-comments-post.php"]
  [network where network.protocol == "http" and http.request.method == "POST" and
    url.path contains "wp-comments-post.php" and
    http.request.body.content regex ".*(<script|onerror=|onload=|javascript:).*"]

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST" AND uri_path LIKE "%wp-comments-post.php%"
| eval suspicious=if(match(form_data, "(?i)(<script|onerror=|onload=|javascript:)"), 1, 0)
| where suspicious=1
| stats count values(src_ip) as source_ips values(uri) as uris by host
| where count > 0

Wazuh OSSEC Rule

<group name="wordpress,web,xss,">
  <rule id="100641" level="12">
    <if_sid>31100</if_sid>
    <id>^POST$</id>
    <url>wp-comments-post.php</url>
    <match>script|onerror=|onload=|javascript:</match>
    <description>CVE-2026-97641: Possible Relevanssi plugin stored XSS attempt via comment content</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_97641,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix or official workaround is available at the time of this report.

1. Immediate mitigations:

   • Disable comments site-wide, or enable strict moderation so anonymous comment content is not published without review. Because the flaw is triggered through comment content, controlling comment publication directly reduces exposure.
   • Clear the "Allowable tags in excerpts" setting in Relevanssi so it contains no allowable tags, which per the NVD description removes the exploitation precondition.
   • Deploy a web application firewall (WAF) with virtual patching rules to block script-capable markup in comment submission payloads.
   • Consider temporarily disabling the Relevanssi plugin if comments cannot be restricted and the excerpt tag setting must remain configured.

2. Patch/upgrade steps:

   • No patched version is currently identified by any tracked source. Monitor the plugin vendor's release channels and the NVD entry for CVE-2026-97641 for an official fix.
   • When a patched release becomes available, back up the site, verify the fix version, and upgrade immediately. Test in a staging environment before production.

3. Long-term hardening:

   • Apply context-aware output encoding for all user-supplied content rendered in excerpts and search results.
   • Replace prefix-based allowlist filtering with strict, properly anchored tag validation to prevent prefix-bypass techniques.
   • Enforce Content Security Policy (CSP) headers to limit script execution even if markup injection occurs.
   • Enable security headers, keep WordPress core, themes, and plugins updated, and perform regular vulnerability scanning.
   • Restrict anonymous commenting where business requirements allow and monitor comment submissions for suspicious markup.

References

• NVD — CVE-2026-97641: https://nvd.nist.gov/vuln/detail/CVE-2026-97641
• Relevanssi – A Better Search WordPress plugin: https://wordpress.org/plugins/relevanssi/
• CWE-79 — Improper Neutralization of Input During Web Page Generation (Cross-site Scripting): https://cwe.mitre.org/data/definitions/79.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities Catalog (checked; CVE-2026-97641 not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No public PoC, exploit code, or Nuclei template is available for CVE-2026-97641. No threat actor campaigns or exploit-in-the-wild evidence have been identified at the time of writing.