CVE-2025-5016

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

The Relevanssi – A Better Search plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Excerpt Highlights in all versions up to, and including, 4.24.5 (Free) and 2.27.6 (Premium) due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
May 31, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-501608.0Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network.CVE-2025-501617.3Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.CVE-2025-501628.0Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network.CVE-2025-501638.8Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a networCVE-2025-501648.0Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network.CVE-2025-501659.8Untrusted pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to execute code over a network.CVE-2025-501666.5Integer overflow or wraparound in Windows Distributed Transaction Coordinator allows an authorized attacker to disclose information over a nCVE-2025-501677.0Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attackerCVE-2025-501687.8Access of resource using incompatible type ('type confusion') in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges CVE-2025-501697.5Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB allows an unauthorized attacker tCVE-2025-50174.9The Catalyst Connect Zoho CRM Client Portal plugin for WordPress is vulnerable to time-based SQL Injection via the ‘uid’ parameter in all veCVE-2025-501707.8Improper handling of insufficient permissions or privileges in Windows Cloud Files Mini Filter Driver allows an authorized attacker to eleva