CVE-2026-109995: Advanced Views <= 3.9.6 - Unauthenticated Stored Cross-Site Scripting via Comment Content
The Advanced Views – Display Framework for Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.9.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is exploitable even against pending or unapproved comments, as the plugin's getcomment() lookup applies no approval-status filter, meaning a payload executes for any visitor loading an avf-layout block bound to the attacker's comment ID before the comment is ever reviewed.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to this issue?
WordPress sites using the Advanced Views plugin in version 3.9.6 or earlier are affected. Exposure requires an avf-layout block that is bound to the attacker-controlled comment ID to be loaded by a visitor.
Does an attacker need an account or comment approval to exploit it?
No. An unauthenticated attacker can supply malicious script through comment content, and the affected comment does not need to be approved or reviewed before the payload can execute.
Who can trigger the stored script once it has been injected?
Any user who loads the affected page can trigger the script, including visitors. The script executes when the page loads an avf-layout block bound to the attacker’s comment ID.
Can pending or unapproved comments be used as an indicator of compromise?
Yes. Pending and unapproved comments are relevant because the vulnerable lookup does not filter by approval status. Review comment content and identify avf-layout blocks bound to comment IDs, including IDs for comments that were never approved.