{
 "id": "WPSEC-2026-0742",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0742/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0742/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0742/index.md",
 "title": "annasta Woocommerce Product Filters <= 1.8.4 - Authenticated (Author+) Stored Cross-Site Scripting via Meta Data Filter Values",
 "description": "The annasta Filters for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via meta data filter values in all versions up to, and including, 1.8.4 due to insufficient output escaping. Post meta values for the configured meta key were collected from any published post, not only products, and rendered unescaped as filter item names on the frontend. This makes it possible for authenticated attackers, with author-level access and above, to add a custom field with the filtered meta key to a published post and inject arbitrary web scripts that execute whenever a user views a page containing the filter. Exploitation requires a meta data filter configured with a non-protected meta key.",
 "plugin": {
  "slug": "annasta-woocommerce-product-filters",
  "name": "annasta Woocommerce Product Filters",
  "full_name": "annasta Filters for WooCommerce",
  "wordpress_org": "https://wordpress.org/plugins/annasta-woocommerce-product-filters/",
  "advisories_url": "https://wpsec.com/vuln/plugin/annasta-woocommerce-product-filters/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/annasta-woocommerce-product-filters"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 4.9,
  "vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.8.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.8.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.8.5",
 "remediation": "Update to 1.8.5 or later.",
 "fix_released": "2026-10-09T06:16:20+00:00",
 "published": "2026-10-10T15:41:27+00:00",
 "updated": "2026-10-10T14:53:59.794656+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0742/",
  "https://plugins.svn.wordpress.org/annasta-woocommerce-product-filters/tags/1.8.5/",
  "https://wordpress.org/plugins/annasta-woocommerce-product-filters/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/annasta-woocommerce-product-filters",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-10"
 }
}