annasta Woocommerce Product Filters <= 1.8.4 - Authenticated (Author+) Stored Cross-Site Scripting via Meta Data Filter Values
- ID
- WPSEC-2026-0742
- Plugin
- annasta Filters for WooCommerce (annasta-woocommerce-product-filters)
- Affected
- all versions before 1.8.5
- Remediation
- Update to 1.8.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-10
- Attack surface
- annasta Woocommerce Product Filters on WPSec AttackSurface
- Fix released
- Published
Description
The annasta Filters for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via meta data filter values in all versions up to, and including, 1.8.4 due to insufficient output escaping. Post meta values for the configured meta key were collected from any published post, not only products, and rendered unescaped as filter item names on the frontend. This makes it possible for authenticated attackers, with author-level access and above, to add a custom field with the filtered meta key to a published post and inject arbitrary web scripts that execute whenever a user views a page containing the filter. Exploitation requires a meta data filter configured with a non-protected meta key.
References
- https://wpsec.com/vuln/WPSEC-2026-0742/
- https://plugins.svn.wordpress.org/annasta-woocommerce-product-filters/tags/1.8.5/
- https://wordpress.org/plugins/annasta-woocommerce-product-filters/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS