EUVD-2026-93043
GHSA-65f4-5hwr-wvhw
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious XSS payload URL
-
DeliveryDeliver link to site admin/visitor
-
ExploitVictim loads page, payload reflected unsanitized
-
ExecutionScript executes in victim browser session
-
ImpactHijack session or perform actions as victim
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the 'Blog, Posts and Category Filter for Elementor' plugin (version 2.1.0 or earlier) installed and active on a WordPress site. Exploitation is unauthenticated (PR:N) but is gated by required user interaction (UI:R): a victim - typically a logged-in administrator or site visitor - must load the attacker-crafted request/link for the injected script to execute in their browser. The primary limiting factors are this mandatory victim interaction and the requirement that the vulnerable plugin be present and enabled; there is no evidence of a non-default configuration dependency. |
| Impact | This is a moderate-severity reflected/stored Cross-Site Scripting flaw (CWE-79) in a WordPress Elementor add-on, scored CVSS 7.1 via vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. The signals are internally consistent: network-reachable (AV:N), low complexity (AC:L), no privileges (PR:N), but crucially requires user interaction (UI:R), and the scope change (S:C) plus the partial C/I/A impacts reflect XSS crossing the security boundary into the victim's browser session. No EPSS score, CISA KEV listing, or public POC was provided in the intelligence, so there is no evidence of active exploitation or automatable mass exploitation - this looks like a routine, researcher-reported (Patchstack) web-app vulnerability rather than an urgent incident. The 'A:L' availability impact assigned upstream is questionable for XSS and likely inflates the base score slightly; XSS rarely affects availability. Overall this is a real-but-not-emergency priority: patch in normal cycles, prioritized by how exposed the affected site is, not a drop-everything issue. Note the UI:R requirement meaningfully lowers real-world risk versus a true no-interaction remote flaw. |
| Exploit ScenarioDerived | An unauthenticated attacker crafts a malicious URL or injects a payload into a parameter/field processed by the plugin's blog/category filter, then lures an authenticated administrator or site visitor into loading it. When the victim's browser renders the unsanitized output, attacker-controlled JavaScript executes in their session, enabling session/cookie theft or admin actions. No public exploit code was identified at time of analysis, and successful attack depends on the victim interacting with the crafted content (UI:R). |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Unauthenticated cross-site scripting in the WordPress plugin 'Blog, Posts and Category Filter for Elementor' (versions 2.1.0 and earlier) lets remote attackers inject script that executes in the browser of a victim who loads a crafted request or link. The flaw is scored CVSS 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) and requires no authentication (PR:N), but exploitation is gated by mandatory victim interaction (UI:R) - typically a logged-in administrator or a site visitor must be lured into opening the attacker-supplied URL for the payload to run. Sites are only exposed if the affected plugin is installed and active; no public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS data was not available for this CVE.
RemediationAI
No vendor-released patch version is identified in the available data, so the immediate priority is to check for a newer release of 'Blog, Posts and Category Filter for Elementor' from the WordPress plugin repository and upgrade as soon as an update past 2.1.0 becomes available, then verify the installed version matches the fixed release. If no update can be applied, deactivate and remove the plugin - a blunt but effective measure for eliminating the exposed code path, with the trade-off that the blog/post/category filter functionality in Elementor layouts is lost until a fixed version is deployed. As interim compensating controls, deploy WAF or virtual-patching rules that sanitize/block script payloads targeting the plugin's filter parameters (effective against known attack patterns but bypassable by novel encodings), and reduce the victim pool by enforcing least privilege and avoiding administrator browsing of untrusted links from the site. Monitor the vendor/Patchstack advisory at https://patchstack.com/database/wordpress/plugin/blog-posts-and-category-for-elementor/vulnerability/wordpress-blog-posts-and-category-filter-for-elementor-plugin-2-1-0-cross-site-scripting-xss-vulnerability for the patched release; also audit site content and user sessions for injected script remnants if the plugin has been exposed while unpatched.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), i.e. classic cross-site scripting in a third-party Elementor add-on for WordPress. The CPE string cpe:2.3:a:plugin_devs:blog,_posts_and_category_filter_for_elementor:*:*:*:*:*:*:*:* identifies the affected component as the 'Blog, Posts and Category Filter for Elementor' plugin distributed through the WordPress ecosystem, and the vendor-reported advisory is hosted on the Patchstack WordPress vulnerability database. Because the plugin renders blog/post/category filter output inside Elementor-built pages under an AV:N/PR:N context, the vulnerable code path can be reached without credentials; however, the CVSS vector's UI:R and S:C components indicate that the script executes in the victim's browser session rather than the server, and the scope change reflects that the injected content can affect resources beyond the vulnerable component (e.g. the surrounding page or admin session). The independent assessment narrows availability impact to A:N, so the practical impact is limited to script execution, session/data exposure and content integrity within the victim's browser context rather than service disruption.
Know when Blog Posts And Category Filter For Elementor gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated network-reachable XSS (PR:N, AV:N, AC:L) requiring victim interaction (UI:R) with a scope change into the browser (S:C); C:L/I:L for script execution, A:N since XSS does not impair availability.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Blog, Posts and Category Filter for Elementor <= 2.1.0 versions.
Executive ViewAI
A high-severity cross-site scripting flaw in the WordPress plugin 'Blog, Posts and Category Filter for Elementor' (versions 2.1.0 and earlier) allows an attacker to run malicious script in the browser of any user who opens a crafted link, with no authentication required on the attacker's side. Because the plugin is commonly deployed on marketing and content sites, a successful attack could hijack an administrator's session, alter site content, or redirect visitors, creating brand, trust, and potential regulatory exposure. The vendor has not released a fix, so any site running this plugin remains exposed until it is removed or otherwise isolated.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate and remove the affected plugin where not business-critical; deploy WAF or reverse-proxy rules to block crafted requests targeting the plugin; enforce a strict Content Security Policy; require phishing-resistant MFA and least-privilege roles for WordPress administrators; and conduct user awareness messaging to prevent administrators and visitors from opening untrusted links. Exploitation status: no public exploit identified at time of analysis. Authentication: unauthenticated, but exploitation requires victim interaction (UI:R).
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB