CVE-2026-15941

A vulnerability in the plugin's Admin Search feature enables users with `edit_posts` permissions to perform Relevanssi searches from the WordPress dashboard using AJAX. The issue arises because user-controlled taxonomy data is sanitized but not properly parameterized before being used in a term taxonomy query, allowing an authenticated attacker at the contributor level to inject SQL and execute time-based blind SQL injection attacks against the database.

Based on public CVE data (MITRE/NVD).