What the vulnerability does
01Description
The Product Filter Widget for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'args[filterFormArray]' Parameter in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The endpoint is registered via wp_ajax_nopriv_ with no nonce verification or capability check, and exploitation is delivered via a CSRF-style form auto-submission to the admin-ajax.php endpoint, requiring the attacker to trick a victim into visiting an attacker-controlled page.
Explanation of Vulnerability in Simple Terms
02Summary
The Product Filter Widget for Elementor versions 1.0.6 and earlier contain a cross-site scripting (XSS) vulnerability. An attacker can inject malicious scripts that execute in visitors' browsers when they interact with the widget. The vulnerability requires user interaction and can affect other users on the site. Update to a version newer than 1.0.6 to resolve this issue.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts that run in visitors' browsers when they use the filter widget.
Potential impact on your site
04Site Impact
Visitors' browsers can execute attacker-controlled scripts, potentially stealing session data or redirecting users.
Conditions required to exploit
05Prerequisites
Visitor must interact with the affected filter widget on a page containing the vulnerable component.
Key dates
06Disclosure timeline
June 9, 2026
CVE published
June 9, 2026
Record updated
