Plugin security history

Relevanssi – A Better Search Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 17 vulnerability records associated with Relevanssi – A Better Search, published between 2014 and 2025.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

17Total records

1Critical

3High

13Medium

0Low

0Informational

17Patched records

0Currently marked unpatched

2014-02-25First disclosure

2025-12-17Latest disclosure

13 of 17CVE coverage

Year-by-Year Timeline

Year	Records	Relative volume
2014	1	1 records
2015	1	1 records
2017	1	1 records
2018	2	2 records
2021	1	1 records
2022	1	1 records
2024	6	6 records
2025	4	4 records

Severity Breakdown

Severity	Records	Share
Critical	1	5.9%
High	3	17.6%
Medium	13	76.5%

Vulnerability-Type Breakdown

Cross-Site Scripting

7 records41.2%

First: 2015. Latest: 2025.

SQL Injection

4 records23.5%

First: 2014. Latest: 2025.

Missing Authorization

4 records23.5%

First: 2022. Latest: 2024.

Other

1 record5.9%

First: 2024. Latest: 2024.

Information Disclosure

1 record5.9%

First: 2024. Latest: 2024.

Patch Status

Patched: 17
Currently marked unpatched: 0
Unknown status: 0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

4.26.0
4.24.6
4.24.5
4.24.4
4.23.1
4.23.0
4.22.2
4.22.1
4.22.0
4.14.6
4.14.4
3.6.1
4.0.5
3.5.8
3.3.8
3.3.1

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected range	Vulnerability	Published	Patched version	Severity
`[*, 4.26.0)`	Relevanssi < 4.26.0 (Free) < 2.29.0 (Premium) - Authenticated (Contributor+) SQL Injection	December 17, 2025	4.26.0	Medium
`*-4.24.5`	Relevanssi <= 4.24.5 (Free) and <= 2.27.6 (Premium) - Unauthenticated Stored Cross-Site Scripting via Excerpt Highlights	May 30, 2025	4.24.6	Medium
`*-4.24.4`	Relevanssi <= 4.24.4 (Free) and <= 2.27.5 (Premium) - Unauthenticated SQL Injection	May 12, 2025	4.24.5	High
`*-4.24.3`	Relevanssi <= 4.24.3 (Free) and <= 2.27.4 (Premium) - Unauthenticated Stored Cross-Site Scripting via Search Highlights	May 6, 2025	4.24.4	Medium
`*-4.23.0`	Relevanssi – A Better Search <= 4.23.0 (Free) and <= 2.26.0 (Premium) - Authenticated (Contributor+) Stored Cross-Site Scripting	September 17, 2024	4.23.1	Medium
`*-4.22.2`	Relevanssi <= 4.22.2 (Free) and <= 2.25.1 (Premium) - Unauthenticated Information Exposure	August 15, 2024	4.23.0	Medium
`*-4.22.1`	Relevanssi – A Better Search <= 4.22.1 - Missing Authorization to Unauthenticated Count Option Update	April 4, 2024	4.22.2	Medium
`*-4.22.1`	Relevanssi – A Better Search <= 4.22.1 - Unauthenticated Second Order CSV Injection	April 4, 2024	4.22.2	Medium
`*-4.22.0`	Relevanssi – A Better Search <= 4.22.0 (Free) and <= 2.25.0 (Premium) - Missing Authorization to Unauthenticated Query Log Export	February 22, 2024	4.22.1	Medium
`*-4.21.2`	Relevanssi <= 4.21.2 (Free) and < 2.25.0 (Premium) - Missing Authorization to Unauthorized Post Access	January 4, 2024	4.22.0	Medium
`[*, 4.14.6)`	Relevanssi – A Better Search < 4.14.6 & Relevanssi – A Better Search Pro < 2.16.5 - Missing Authorization	February 15, 2022	4.14.6	Medium
`[*, 4.14.3)`	Relevanssi - A Better Search Free & Premium <= 2.16.3 & 4.14.3 - Stored Cross-Site Scripting	October 19, 2021	4.14.4	High
`[*, 3.6.1)`	Relevanssi <= 3.6.0 - Authenticated (Admin+) SQL Injection	April 10, 2018	3.6.1	High
`*-4.0.4`	Relevanssi <= 4.0.4 - Cross-Site Scripting	March 30, 2018	4.0.5	Medium
`[*, 3.5.8)`	Relevanssi – A Better Search <= 3.5.7.1 - Stored Cross-Site Scripting	February 28, 2017	3.5.8	Medium
`[*, 3.3.8)`	Relevanssi – A Better Search < 3.3.8 - Cross-Site Scripting	January 3, 2015	3.3.8	Medium
`*-3.3`	Relevanssi <= 3.3 - SQL Injection	February 25, 2014	3.3.1	Critical

Selected source records

Latest Records

MediumCVE-2025-14719

Relevanssi < 4.26.0 (Free) < 2.29.0 (Premium) - Authenticated (Contributor+) SQL Injection

Published: December 17, 2025

Affected versions: [*, 2.29.0)
Patched versions: 2.29.0

Affected versions: [*, 4.26.0)
Patched versions: 4.26.0

Original Wordfence record

MediumCVE-2025-5016

Relevanssi <= 4.24.5 (Free) and <= 2.27.6 (Premium) - Unauthenticated Stored Cross-Site Scripting via Excerpt Highlights

Published: May 30, 2025

Affected versions: *-2.27.6
Patched versions: 2.27.7

Affected versions: *-4.24.5
Patched versions: 4.24.6

Original Wordfence record

HighCVE-2025-4396

Relevanssi <= 4.24.4 (Free) and <= 2.27.5 (Premium) - Unauthenticated SQL Injection

Published: May 12, 2025

Affected versions: *-2.27.5
Patched versions: 2.27.6

Affected versions: *-4.24.4
Patched versions: 4.24.5

Original Wordfence record

MediumCVE-2025-4054

Relevanssi <= 4.24.3 (Free) and <= 2.27.4 (Premium) - Unauthenticated Stored Cross-Site Scripting via Search Highlights

Published: May 6, 2025

Affected versions: *-2.27.4
Patched versions: 2.27.5

Affected versions: *-4.24.3
Patched versions: 4.24.4

Original Wordfence record

MediumCVE-2024-9021

Relevanssi – A Better Search <= 4.23.0 (Free) and <= 2.26.0 (Premium) - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: September 17, 2024

Affected versions: *-2.26.0
Patched versions: 2.26.1

Affected versions: *-4.23.0
Patched versions: 4.23.1

Original Wordfence record

MediumCVE-2024-7630

Relevanssi <= 4.22.2 (Free) and <= 2.25.1 (Premium) - Unauthenticated Information Exposure

Published: August 15, 2024

Affected versions: *-2.25.1
Patched versions: 2.25.2

Affected versions: *-4.22.2
Patched versions: 4.23.0

Original Wordfence record

MediumCVE-2024-3214

Relevanssi – A Better Search <= 4.22.1 - Unauthenticated Second Order CSV Injection

Published: April 4, 2024

Affected versions: *-2.25.1
Patched versions: 2.25.2

Affected versions: *-4.22.1
Patched versions: 4.22.2

Original Wordfence record

MediumCVE-2024-3213

Relevanssi – A Better Search <= 4.22.1 - Missing Authorization to Unauthenticated Count Option Update

Published: April 4, 2024

Affected versions: *-2.25.1
Patched versions: 2.25.2

Affected versions: *-4.22.1
Patched versions: 4.22.2

Original Wordfence record

Highest-Severity Records

Critical

Relevanssi <= 3.3 - SQL Injection

Published: February 25, 2014

Affected versions: *-3.3
Patched versions: 3.3.1

Original Wordfence record

High

Relevanssi <= 3.6.0 - Authenticated (Admin+) SQL Injection

Published: April 10, 2018

Affected versions: [*, 3.6.1)
Patched versions: 3.6.1

Original Wordfence record

HighCVE-2025-4396

Relevanssi <= 4.24.4 (Free) and <= 2.27.5 (Premium) - Unauthenticated SQL Injection

Published: May 12, 2025

Affected versions: *-2.27.5
Patched versions: 2.27.6

Affected versions: *-4.24.4
Patched versions: 4.24.5

Original Wordfence record

High

Relevanssi - A Better Search Free & Premium <= 2.16.3 & 4.14.3 - Stored Cross-Site Scripting

Published: October 19, 2021

Affected versions: [*, 2.16.3)
Patched versions: 2.16.4

Affected versions: [*, 4.14.3)
Patched versions: 4.14.4

Original Wordfence record

MediumCVE-2025-14719

Relevanssi < 4.26.0 (Free) < 2.29.0 (Premium) - Authenticated (Contributor+) SQL Injection

Published: December 17, 2025

Affected versions: [*, 2.29.0)
Patched versions: 2.29.0

Affected versions: [*, 4.26.0)
Patched versions: 4.26.0

Original Wordfence record

MediumCVE-2024-9021

Relevanssi – A Better Search <= 4.23.0 (Free) and <= 2.26.0 (Premium) - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: September 17, 2024

Affected versions: *-2.26.0
Patched versions: 2.26.1

Affected versions: *-4.23.0
Patched versions: 4.23.1

Original Wordfence record

Medium

Relevanssi – A Better Search < 4.14.6 & Relevanssi – A Better Search Pro < 2.16.5 - Missing Authorization

Published: February 15, 2022

Affected versions: [*, 2.16.5)
Patched versions: 2.16.5

Affected versions: [*, 4.14.6)
Patched versions: 4.14.6

Original Wordfence record

MediumCVE-2017-1000038

Relevanssi – A Better Search <= 3.5.7.1 - Stored Cross-Site Scripting

Published: February 28, 2017

Affected versions: [*, 3.5.8)
Patched versions: 3.5.8

Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware Removal WordPress Security Maintenance Contact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory