HUSKY Products Filter CVE-2026-18562

Victim must click a specially crafted URL (UI:R); no passive or drive-by exploitation path exists. The attacker requires no authentication or account on the target site (PR:N). The vulnerable code path activates specifically when the HUSKY plugin's url_request extension processes SEO-friendly permalink-style filter URLs - the parse_url_query() method parses filter state from URL path segments rather than from conventional query parameters. Sites using HUSKY with standard query-string filter mode may not trigger the vulnerable path. Exploitation is limited to plugin versions ≤1.4.3. The highest-impact targets are authenticated WooCommerce administrators, whose compromised sessions grant full store management access; ordinary visitor sessions yield only limited impact (C:L/I:L consistent with CVSS).

CVSS 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) accurately captures this as moderate severity: the attack is network-delivered with no authentication required, but the mandatory user-interaction requirement (UI:R) significantly limits opportunistic, automated mass exploitation. No CISA KEV listing and no public exploit code identified at time of analysis, reducing immediate urgency beyond patch-cycle priority. EPSS data is absent from available sources, but reflected XSS in WordPress plugins rarely achieves high EPSS without a weaponized dropper campaign specifically targeting admin sessions. The most meaningful real-world risk is targeted phishing against WooCommerce administrators: admin session compromise opens the door to payment skimming, plugin backdooring, or customer data exfiltration. Even a small e-commerce deployment should treat this as an urgent patching priority, since the unauthenticated delivery path and the high-value WooCommerce admin attack surface make it an attractive link in a targeted attack chain despite the moderate base score.

An attacker identifies a WooCommerce store running HUSKY ≤1.4.3 with SEO-friendly permalinks enabled, then constructs a product filter URL in which a filter path segment contains a single-quote followed by a JavaScript cookie-exfiltration payload. The attacker sends this URL to a store administrator via a phishing email disguised as a customer support link or a WooCommerce notification. When the administrator clicks the link, wp_load_js() renders the unsanitized filter value inside an inline script block, the injected code executes in the admin's browser, and the session token is exfiltrated to an attacker-controlled endpoint, granting full backend access. No public exploit code has been identified at time of analysis.