CVE-2026-116390

HighCVSS 7.2

Published: 28/10/2026(UTC)Updated: 29/10/2026(UTC)Translated: 28/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

23th percentile - higher than 23% of all known CVEs

Summary

The WordPress plugin Filter Everything — WordPress & WooCommerce Filters through 1.9.7 contains a deserialization of untrusted data vulnerability allowing Object Injection.

Risk Assessment

Object injection via untrusted data may lead to unintended actions within the WordPress application context.

Recommendation

Update the Filter Everything plugin to a version newer than 1.9.7 that contains the deserialization fix.

Other vulnerabilities in Filter Everything

CVE-2026-87869Medium
The Filter Everything — WordPress & WooCommerce Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to and including 1.9.6 due to insufficient input sanitization and output escaping in the flrt_elementor_load_more_anchor() function. The function reads query parameters from $_SERVER['REQUEST_URI'] via getFormActionOrFullPageUrl(true), which URL-decodes them through parse_str() and re-assembles them using build_query() — a WordPress core function that does NOT re-encode values ($urlencode=false). The resulting URL, containing unescaped special characters, is injected into a data-next-page HTML attribute via preg_replace() without esc_attr() or esc_url(). This allows unauthenticated attackers to inject arbitrary web scripts that execute if they can trick a user into clicking a specially crafted link.

Original NVD description (English source)

Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything — WordPress & WooCommerce Filters filter-everything allows Object Injection.This issue affects Filter Everything — WordPress & WooCommerce Filters: from n/a through 1.9.7.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS