CVE-2025-14719: Unknown Relevanssi

Medium severity, CVSS 4.9. EPSS: 0.3% chance of exploitation in the next 30 days.

The Relevanssi WordPress plugin before 4.26.0, Relevanssi Premium WordPress plugin before 2.29.0 do not sanitize and escape a parameter before using it in a SQL statement, allowing contributor and above roles to perform SQL injection attacks

Affected products

• Unknown Relevanssi: before 4.26.0 (fixed in 4.26.0)
• Unknown Relevanssi Premium: before 2.29.0 (fixed in 2.29.0)

Published 2026-01-07. Last modified 2026-06-17.