PLUGIN SECURITY
Is Relevanssi safe?
Relevanssi replaces the default search with a partial-match search that sorts results by relevance. It also indexes comments and shortcode content.
What this plugin does
- Slug:
relevanssi - Author: Christoph Vielgrader
- 100000+ active installs
- 96/100 rating (405 reviews on wordpress.org)
- 8211583 all-time downloads
- On WordPress.org since 2009-06-30
better searchproduct searchrelevancesearchwoocommerce search
Maintenance status
- Latest known version: 4.28.1
- Last updated: 2026-08-17 3:02am GMT
- Tested up to WordPress: 7.1
- Requires PHP: 7.1+
- Max supported PHP (analyzed): 8.4
Known vulnerabilities
14 known CVEs on file for Relevanssi.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-15941 | Relevanssi – A Better Search [relevanssi] < 4.27.2 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Medium 6.5 | < 4.27.2 | 4.27.2 | 2026-08-04 | ✓ fixed in latest |
| CVE-2025-14719 | Relevanssi – A Better Search [relevanssi] < 4.26.0 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | Medium 4.9 | < 4.26.0 | 4.26.0 | 2025-12-17 | ✓ fixed in latest |
| CVE-2024-9021 | Relevanssi – A Better Search [relevanssi] < 4.23.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 4.23.1 | 4.23.1 | 2024-09-17 | ✓ fixed in latest |
| CVE-2024-7630 | Relevanssi – A Better Search [relevanssi] < 4.23.0 | Exposure of Sensitive Information to an Unauthorized Actor | High 7.5 | < 4.23.0 | 4.23.0 | 2024-08-15 | ✓ fixed in latest |
| CVE-2024-3214 | Relevanssi – A Better Search [relevanssi] < 4.22.2 | Improper Neutralization of Formula Elements in a CSV File | Critical 9.8 | < 4.22.2 | 4.22.2 | 2024-04-04 | ✓ fixed in latest |
| CVE-2024-3213 | Relevanssi – A Better Search [relevanssi] < 4.22.2 | Missing Authorization | High 8.2 | < 4.22.2 | 4.22.2 | 2024-04-04 | ✓ fixed in latest |
| CVE-2024-1380 | Relevanssi – A Better Search [relevanssi] < 4.22.1 | Missing Authorization | Medium 5.3 | < 4.22.1 | 4.22.1 | 2024-02-22 | ✓ fixed in latest |
| CVE-2023-7199 | Relevanssi – A Better Search [relevanssi] < 4.22.0 | Authorization Bypass Through User-Controlled Key | Medium 5.3 | < 4.22.0 | 4.22.0 | 2024-01-04 | ✓ fixed in latest |
+ 29 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| — | Relevanssi – A Better Search [relevanssi] < 4.14.6 | — | Unknown | < 4.14.6 | 4.14.6 | 2022-02-15 | ✓ fixed in latest |
| — | Relevanssi – A Better Search [relevanssi] < 4.14.6 | — | Unknown | < 4.14.6 | 4.14.6 | 2022-02-15 | ✓ fixed in latest |
| — | Relevanssi – A Better Search [relevanssi] < 4.14.3 | — | Unknown | < 4.14.3 | 4.14.3 | 2021-10-19 | ✓ fixed in latest |
| — | Relevanssi – A Better Search [relevanssi] < 4.14.4 | — | Unknown | < 4.14.4 | 4.14.4 | 2021-10-19 | ✓ fixed in latest |
| — | Relevanssi – A Better Search [relevanssi] < 3.6.1 | — | Unknown | < 3.6.1 | 3.6.1 | 2018-04-10 | ✓ fixed in latest |
| CVE-2018-9034 | Relevanssi – A Better Search [relevanssi] < 4.0.5 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 4.0.5 | 4.0.5 | 2018-03-30 | ✓ fixed in latest |
| CVE-2017-1000038 | Relevanssi – A Better Search [relevanssi] < 3.5.8 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 3.5.8 | 3.5.8 | 2017-02-28 | ✓ fixed in latest |
| — | Relevanssi – A Better Search [relevanssi] < 3.3 | — | Unknown | < 3.3 | 3.3 | 2015-05-15 | ✓ fixed in latest |
| CVE-2014-9443 | Relevanssi – A Better Search [relevanssi] < 3.3.8 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Unknown | < 3.3.8 | 3.3.8 | 2015-01-02 | ✓ fixed in latest |
| — | Relevanssi – A Better Search [relevanssi] < 3.4 | — | Unknown | < 3.4 | 3.4 | 2014-03-04 | ✓ fixed in latest |
| — | Relevanssi – A Better Search [relevanssi] < 3.3.1 | — | Unknown | < 3.3.1 | 3.3.1 | 2014-02-25 | ✓ fixed in latest |
| — | Relevanssi – A Better Search [relevanssi] < 2.7.3 | — | Unknown | < 2.7.3 | 2.7.3 | 2011-02-24 | ✓ fixed in latest |
| — | Relevanssi – A Better Search [relevanssi] < 4.24.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 4.24.4 | 4.24.4 | 0000-00-00 | ✓ fixed in latest |
| — | Relevanssi – A Better Search [relevanssi] < 4.24.5 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 7.5 | < 4.24.5 | 4.24.5 | 0000-00-00 | ✓ fixed in latest |
| — | Relevanssi – A Better Search [relevanssi] < 4.24.6 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.7 | < 4.24.6 | 4.24.6 | 0000-00-00 | ✓ fixed in latest |
| — | Relevanssi – A Better Search [relevanssi] < 4.14.6 | — | Unknown | < 4.14.6 | 4.14.6 | — | ✓ fixed in latest |
| — | Relevanssi – A Better Search [relevanssi] < 4.14.3 | — | Unknown | < 4.14.3 | 4.14.3 | — | ✓ fixed in latest |
| — | Relevanssi – A Better Search [relevanssi] < 3.6.1 | — | Unknown | < 3.6.1 | 3.6.1 | — | ✓ fixed in latest |
| — | Relevanssi – A Better Search [relevanssi] < 2.7.3 | — | Unknown | < 2.7.3 | 2.7.3 | — | ✓ fixed in latest |
| — | Relevanssi – A Better Search [relevanssi] < 3.3 | — | Unknown | < 3.3 | 3.3 | — | ✓ fixed in latest |
| — | Relevanssi – A Better Search [relevanssi] < 4.22 | — | Unknown | < 4.22 | 4.22 | — | ✓ fixed in latest |
| — | Relevanssi 3.2 - Unspecified SQL Injection | — | Unknown | < 3.3 | 3.3 | — | ✓ fixed in latest |
| — | Relevanssi 2.7.2 - Stored XSS | — | Unknown | < 2.7.3 | 2.7.3 | — | ✓ fixed in latest |
| — | Relevanssi <= 3.6.0 - Authenticated Admin SQL Injection | — | Unknown | < 3.6.1 | 3.6.1 | — | ✓ fixed in latest |
| — | Relevanssi - A Better Search < 4.14.3 - Unauthenticated Stored Cross-Site Scripting | — | Unknown | < 4.14.3 | 4.14.3 | — | ✓ fixed in latest |
| — | Relevanssi - Subscriber+ Unauthorised AJAX Calls | — | Unknown | < 4.14.6 | 4.14.6 | — | ✓ fixed in latest |
| CVE-2025-4054 | Relevanssi <= 4.24.3 (Free) and <= 2.27.4 (Premium) - Unauthenticated Stored Cross-Site Scripting via Search Highlights | — | Unknown | < 4.24.4 | 4.24.4 | — | ✓ fixed in latest |
| CVE-2025-4396 | Relevanssi < 4.24.5 (Free) and < 2.27.5 (Premium) - Unauthenticated SQL Injection | — | Unknown | < 4.24.5 | 4.24.5 | — | ✓ fixed in latest |
| CVE-2025-5016 | Relevanssi <= 4.24.5 (Free) and <= 2.27.6 (Premium) - Unauthenticated Stored Cross-Site Scripting via Excerpt Highlights | — | Unknown | < 4.24.6 | 4.24.6 | — | ✓ fixed in latest |
How to fix it
Keep Relevanssi updated — 4.28.1 is the latest version on wordpress.org, and each CVE above lists the exact release that fixed it ("Fixed in").
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Safer / more established alternatives
- FiboSearch – Ajax Search for WooCommerce — 100000+ active installs — 98/100 (1814) — max PHP 8.4
- Ajax Search Lite – Live Search & Filter — 70000+ active installs — 96/100 (264) — max PHP 8.4
- Advanced Woo Search – Product Search for WooCommerce — 70000+ active installs — 96/100 (248) — max PHP 8.4
- ACF: Better Search — 40000+ active installs — 98/100 (165) — max PHP 8.4
- Themify – WooCommerce Product Filter — 20000+ active installs — 70/100 (72) — max PHP 8.4
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.