At the moment, Jetpack Protect claims Relevanssi Premium has several vulnerabilities. These are all false positives. I am not aware of any current vulnerabilities in Relevanssi Premium.
The vulnerabilities Jetpack Protect reports are old vulnerabilities. They have applied to Relevanssi Premium, but I fixed them long ago. They appear in the report because Jetpack Protect confuses Relevanssi Premium with the free version of Relevanssi. The vulnerability database tells there’s a vulnerability in Relevanssi versions 4.0.4 or lower, and Jetpack Protect sees Relevanssi Premium 2.19.1 and thinks that’s a match. It’s not.
Jetpack Protect reports the same vulnerabilities for Relevanssi Premium Snowball Stemmer, which is even more absurd and shows how little sense there is in these reports.
I’ve reported this, and hopefully, Jetpack Protect will stop reporting these vulnerabilities. Meanwhile, you don’t have to worry about the Relevanssi vulnerabilities Jetpack Protect reports for Relevanssi Premium. It’s worth worrying if Jetpack Protect reports a vulnerability for the current version of Relevanssi Premium.
Update Oct/2022: this problem has been fixed. Jetpack Protect doesn’t complain about these vulnerabilities anymore.
