CVE-2025-14719

Medium · 4.9

CVSS

4.9

EPSS

0.3%

Published

Jan 7, 2026

CISA due date

—

The record

The Relevanssi WordPress plugin before 4.26.0, Relevanssi Premium WordPress plugin before 2.29.0 do not sanitize and escape a parameter before using it in a SQL statement, allowing contributor and above roles to perform SQL injection attacks

Affected packages

Ecosystem	Package	Introduced	Fixed