What is the CVSS score of CVE-2026-45437?

CVE-2026-45437 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Product Filter Widget for Elementor are affected by CVE-2026-45437?

The Product Filter Widget for Elementor plugin (versions ≤ 1.0.6) contains a cross-site scripting vulnerability (CVSS 7.1) with no public exploit identified at time of analysis.

How to fix or mitigate CVE-2026-45437?

Within 24 hours: Identify all WordPress sites running Product Filter Widget for Elementor versions ≤ 1.0.6; disable the plugin immediately as interim mitigation; deploy Web Application Firewall rules blocking XSS payloads in filter parameters. Within 7 days: Review server and application logs for exploitation attempts; audit user sessions for signs of compromise; prepare incident notification process if evidence of abuse is found. Within 30 days: Deploy vetted replacement filtering solution; establish vendor security advisory monitoring; implement organization-wide Content Security Policy headers.

Product Filter Widget for Elementor CVE-2026-45437

EUVD-2026-36840 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-06-15 Patchstack

GHSA-74gf-g3qr-4w7c

WordPress XSS Wordpress Plugin Product Filter Widget For Elementor Elementor

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

7.1 HIGH

Network-delivered reflected XSS requires victim click (UI:R) and no auth (PR:N); scope changes to victim browser context with limited C/I/A impact typical of XSS.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Jun 15, 2026 - 21:54 vuln.today

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Product Filter Widget for Elementor <= 1.0.6 versions.

AnalysisAI

Reflected/stored cross-site scripting in the Product Filter Widget for Elementor WordPress plugin (versions <= 1.0.6) allows unauthenticated remote attackers to inject malicious script that executes in a victim's browser after user interaction. The flaw was disclosed via Patchstack and carries a CVSS 3.1 score of 7.1 with scope change due to script execution in the browser context; no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

Technical ContextAI

The affected component is a third-party WordPress plugin (vendor 'bhavin_thummar', product 'product_filter_widget_for_elementor') that extends Elementor page builder with product filtering UI for WooCommerce-style storefronts. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), meaning user-controlled input - likely passed through filter query parameters or widget configuration fields - is rendered back into the page DOM without adequate sanitization/encoding, allowing arbitrary HTML/JavaScript injection. Because the plugin runs on top of WordPress + Elementor, the injected payload executes in the same origin as the site, granting access to session cookies, the WordPress nonce surface, and any logged-in administrator's authenticated DOM context.

RemediationAI

Upstream fix available per Patchstack advisory; released patched version not independently confirmed from the provided data, so administrators should upgrade Product Filter Widget for Elementor to the latest version above 1.0.6 as published on the WordPress.org plugin repository and consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/product-filter-widget-for-elementor/vulnerability/wordpress-product-filter-widget-for-elementor-plugin-1-0-6-cross-site-scripting-xss-vulnerability for the exact fixed release. If immediate patching is not possible, deactivate and remove the plugin from any production WordPress site (this disables the filter widget on product pages, which is the main functional trade-off), or place the site behind a WAF with rule sets that block reflected XSS patterns on the plugin's filter parameters (trade-off: WAF rules can produce false positives on legitimate filter queries). Additionally, enforce a strict Content-Security-Policy that disallows inline scripts on storefront pages to reduce payload execution surface, accepting that some Elementor widgets may break under strict CSP.