CVE-2026-87869: Filter Everything — WordPress & WooCommerce Filters <= 1.9.6 - Reflected Cross-Site Scripting via Elementor Posts Widget Pagination URL

Q: Who is exposed to this issue?

Sites using Filter Everything versions through 1.9.6 are affected when the Elementor Posts widget pagination functionality renders the vulnerable next-page URL. An attacker does not need an account, but a victim must be induced to interact with a specially crafted link or similar request.

Q: What can an attacker do if exploitation succeeds?

An attacker can inject arbitrary script into the affected page through crafted URL query parameters. The script runs in the context of the victim's browser when the malicious URL is processed.

Q: What conditions are needed for exploitation?

The vulnerable plugin code must process attacker-controlled query parameters while generating the Elementor Posts widget pagination anchor. Exploitation is network-accessible and requires no attacker privileges, but it requires user interaction.

Published Oct 10, 2026

Updated

The Filter Everything — WordPress & WooCommerce Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.9.6. This is due to insufficient input sanitization and output escaping in the flrtelementorloadmoreanchor() function. The function reads query parameters from $SERVER['REQUESTURI'] via getFormActionOrFullPageUrl(true), which URL-decodes them through parsestr() and re-assembles them using buildquery() — a WordPress core function that does NOT re-encode values ($urlencode=false). The resulting URL, containing unescaped special characters, is injected into a data-next-page HTML attribute via pregreplace() without escattr() or escurl(). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.

Affected Software

1 affected component

Filter Everything Filter Everything — WordPress & WooCommerce Filters<=1.9.6

Event History

Oct 10, 2026

CVE Published

via MITRE·04:26 AM

Data Sourced

via MITRE·04:26 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:16 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Sites using Filter Everything versions through 1.9.6 are affected when the Elementor Posts widget pagination functionality renders the vulnerable next-page URL. An attacker does not need an account, but a victim must be induced to interact with a specially crafted link or similar request.

What can an attacker do if exploitation succeeds?

An attacker can inject arbitrary script into the affected page through crafted URL query parameters. The script runs in the context of the victim's browser when the malicious URL is processed.

What conditions are needed for exploitation?

The vulnerable plugin code must process attacker-controlled query parameters while generating the Elementor Posts widget pagination anchor. Exploitation is network-accessible and requires no attacker privileges, but it requires user interaction.

CVE-2026-87869: Filter Everything — WordPress & WooCommerce Filters <= 1.9.6 - Reflected Cross-Site Scripting via Elementor Posts Widget Pagination URL

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What can an attacker do if exploitation succeeds?

What conditions are needed for exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What can an attacker do if exploitation succeeds?

What conditions are needed for exploitation?