CVE-2026-18562
Received Received - Intake

Reflected Cross-Site Scripting in HUSKY Products Filter Professional for WooCommerce

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: Wordfence

Description
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via SEO-friendly permalink filter URL segments in versions up to, and including, 1.4.3. This is due to insufficient input sanitization and output escaping in the wp_load_js() function, which reads filter values from the URL path via the url_request extension's parse_url_query() and embeds them into an inline JavaScript string using json_encode() without escaping single quotes. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-18562
EUVD
EUVD-2026-75938

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
husky products_filter_professional_for_woocommerce to 1.4.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Reflected Cross-Site Scripting (XSS) issue in the HUSKY – Products Filter Professional for WooCommerce plugin for WordPress. It affects versions up to and including 1.4.3. The flaw occurs because the plugin does not properly sanitize input from SEO-friendly permalink filter URL segments. Attackers can exploit this by tricking users into clicking a specially crafted link, which injects malicious scripts into web pages.

Detection Guidance

Check for the presence of the HUSKY – Products Filter Professional for WooCommerce plugin version 1.4.3 or lower. Inspect WordPress sites for reflected XSS attempts in URLs containing SEO-friendly permalink filter segments. Monitor for unusual JavaScript execution or user reports of unexpected script behavior.

Impact Analysis

An attacker could steal sensitive information like cookies or session tokens, redirect users to malicious websites, or perform actions on behalf of the user without their knowledge. Since the attack requires user interaction, it relies on social engineering tactics such as phishing emails or deceptive links.

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR or HIPAA requirements for protecting user data. Organizations using the affected plugin may face compliance violations, legal penalties, or reputational damage if user data is compromised through this XSS flaw.

Mitigation Strategies

Update the HUSKY plugin to the latest version immediately. If an update is unavailable, consider disabling the plugin temporarily. Implement input sanitization for URL paths and ensure output escaping for JavaScript strings in WordPress.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18562. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart