CVE-2026-40806: WordPress Blog, Posts and Category Filter for Elementor plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability

Q: Who can exploit this issue?

The vulnerability is unauthenticated, so an attacker does not need a WordPress account or existing privileges to attempt exploitation.

Q: What user interaction is required for impact?

The attack vector is network-based and has low attack complexity, but successful exploitation requires user interaction. The available data does not specify what action the user must take.

Q: Which plugin versions are affected?

Blog, Posts and Category Filter for Elementor versions 2.1.0 and earlier are affected.

Published Oct 6, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in Blog, Posts and Category Filter for Elementor <= 2.1.0 versions.

Affected Software

1 affected component

WordPress Blog, Posts and Category Filter for Elementor<=2.1.0

Event History

Oct 6, 2026

CVE Published

via MITRE·08:34 AM

Data Sourced

via MITRE·08:34 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The vulnerability is unauthenticated, so an attacker does not need a WordPress account or existing privileges to attempt exploitation.

What user interaction is required for impact?

The attack vector is network-based and has low attack complexity, but successful exploitation requires user interaction. The available data does not specify what action the user must take.

Which plugin versions are affected?

Blog, Posts and Category Filter for Elementor versions 2.1.0 and earlier are affected.

CVE-2026-40806: WordPress Blog, Posts and Category Filter for Elementor plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What user interaction is required for impact?

Which plugin versions are affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What user interaction is required for impact?

Which plugin versions are affected?