Live › vulnerability › CVE-2026-114704
Go to dashboardRelevanssi, a WordPress search plugin, deserializes untrusted data, which is an object injection flaw. An attacker who can reach the vulnerable path may be able to run code or manipulate data on the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 14:48 UTC. All times on this page are UTC.
Sites running the Relevanssi WordPress plugin at version 4.28.4 or earlier are affected. Sites that do not have the plugin installed can skip it. The sources do not say which settings or roles make the flaw reachable.
No product ranges from the sources yet.
wp plugin get relevanssi --field=version4.28.4 as affected4.28.4 once the vendor release is confirmed in the plugin repositoryEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Deserialization of Untrusted Data vulnerability in Christoph Vielgrader Relevanssi relevanssi allows Object Injection.This issue affects Relevanssi : from n/a through 4.28.4.
This page as .md · .json · in your agent: get_signal("CVE-2026-114704")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.