Unscored severity · published Jan 2, 2015
CVE-2014-9443
Cross-site scripting (XSS) vulnerability in the Relevanssi plugin before 3.3.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors
–
CVSS
1.6%
EPSS
No
On KEV
Description
Cross-site scripting (XSS) vulnerability in the Relevanssi plugin before 3.3.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.
Exploitation
Is it being used?
Exploit prediction (EPSS)1.6% · higher than 76% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RE
Relevanssi · Relevanssi
3.3.7.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-9443
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-9443
secunia.com
http://secunia.com/advisories/61744
Patch
https://wordpress.org/plugins/relevanssi/changelog/
More from Relevanssi
9.8
CVE-2024-3214
Relevanssi – A Better Search <= 4.22.1 - Unauthenticated Second Order CSV Injection
8.8
CVE-2016-10949
The Relevanssi Premium plugin before 1.14.6.1 for WordPress has SQL injection with resultant unsafe unserialization
8.2
CVE-2024-3213
Relevanssi – A Better Search <= 4.22.1 - Missing Authorization to Unauthenticated Count Option Update
7.5
CVE-2024-7630
Relevanssi <= 4.22.2 (Free) and <= 2.25.1 (Premium) - Unauthenticated Information Exposure
6.1
CVE-2017-1000225
Reflected XSS in Relevanssi Premium version 1.14.8 when using relevanssi_didyoumean() could allow unauthenticated attacker to do almost anything an admin can