# annasta Woocommerce Product Filters <= 1.8.4 - Authenticated (Author+) Stored Cross-Site Scripting via Meta Data Filter Values

- **ID:** WPSEC-2026-0742
- **Plugin:** annasta Filters for WooCommerce (`annasta-woocommerce-product-filters`), https://wordpress.org/plugins/annasta-woocommerce-product-filters/
- **Affected versions:** all versions before 1.8.5
- **Fixed in:** 1.8.5 (Update to 1.8.5 or later.)
- **Severity:** Medium 4.9 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-10)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/annasta-woocommerce-product-filters
- **Fix released:** 2026-10-09
- **Published:** 2026-10-10
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0742/

## Description

The annasta Filters for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via meta data filter values in all versions up to, and including, 1.8.4 due to insufficient output escaping. Post meta values for the configured meta key were collected from any published post, not only products, and rendered unescaped as filter item names on the frontend. This makes it possible for authenticated attackers, with author-level access and above, to add a custom field with the filtered meta key to a published post and inject arbitrary web scripts that execute whenever a user views a page containing the filter. Exploitation requires a meta data filter configured with a non-protected meta key.

## References

- https://wpsec.com/vuln/WPSEC-2026-0742/
- https://plugins.svn.wordpress.org/annasta-woocommerce-product-filters/tags/1.8.5/
- https://wordpress.org/plugins/annasta-woocommerce-product-filters/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0742/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.