CVE-2026-11603

MediumCVSS 6.1

Published: 09/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

11th percentile - higher than 11% of all known CVEs

Summary

The Product Filter Widget for Elementor plugin for WordPress up to version 1.0.6 is vulnerable to Reflected Cross-Site Scripting via the 'args[filterFormArray]' parameter. Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary scripts. Exploitation requires tricking a victim into clicking a link or CSRF-style form auto-submission to admin-ajax.php.

Risk Assessment

Risk of arbitrary JavaScript execution in the browser of an admin or user, potentially leading to session hijacking, defacement, or account takeover.

Recommendation

Immediately update the plugin to the latest version and implement input validation and output escaping for all parameters.

Other vulnerabilities in Product Filter Widget for Elementor

CVE-2026-45437High
Versions of the Product Filter Widget for Elementor up to 1.0.6 are vulnerable to unauthenticated Cross Site Scripting (XSS). An attacker can exploit this vulnerability to inject malicious JavaScript code.

Original NVD description (English source)

The Product Filter Widget for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'args[filterFormArray]' Parameter in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The endpoint is registered via wp_ajax_nopriv_ with no nonce verification or capability check, and exploitation is delivered via a CSRF-style form auto-submission to the admin-ajax.php endpoint, requiring the attacker to trick a victim into visiting an attacker-controlled page.