CVE-2026-115950: WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Smart Widgets Better Post & Filter Widgets for Elementor better-post-filter-widgets-for-elementor allows Stored XSS.This issue affects Better Post & Filter Widgets for Elementor: from n/a through 1.9.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WP Smart Widgets Better Post & Filter Widgets for Elementorto a version that resolves this vulnerability.Fixed in 1.9.2
Event History
Frequently Asked Questions
Which installations are affected?
Better Post & Filter Widgets for Elementor installations running version 1.9.1 or an earlier affected version are impacted. The affected version range is listed as through 1.9.1.
What level of access does an attacker need?
An attacker needs low-level privileges and user interaction is required, according to the CVSS vector. The issue is remotely reachable over the network with low attack complexity.
What is the potential impact of successful exploitation?
Successful exploitation can result in stored cross-site scripting. The CVSS vector indicates low confidentiality, integrity, and availability impact, with the impact extending beyond the vulnerable component's security scope.