CVE-2026-18562: HUSKY <= 1.4.3 - Reflected Cross-Site Scripting
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via SEO-friendly permalink filter URL segments in versions up to, and including, 1.4.3. This is due to insufficient input sanitization and output escaping in the wploadjs() function, which reads filter values from the URL path via the urlrequest extension's parseurlquery() and embeds them into an inline JavaScript string using jsonencode() without escaping single quotes. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue, and what user interaction is required?
An unauthenticated attacker can craft a malicious SEO-friendly filter URL. Script execution requires a victim to perform an action such as clicking the crafted link.
Which deployments are affected?
HUSKY – Products Filter Professional for WooCommerce versions up to and including 1.4.3 are affected. The vulnerable behavior involves SEO-friendly permalink filter URL segments processed through the url_request extension.
What can an attacker do if exploitation succeeds?
The attacker can inject arbitrary web scripts that execute in the context of the affected page visited by the victim. The reported impact includes confidentiality and integrity effects, with no availability impact listed.