What is the CVSS score of CVE-2026-66439?

CVE-2026-66439 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of Advanced AJAX Product Filters are affected by CVE-2026-66439?

Advanced AJAX Product Filters plugin (BeRocket v3.2.0.3 and earlier) exposes WooCommerce customers to credential and session theft via unauthenticated attack from any user clicking a malicious link.

How to fix or mitigate CVE-2026-66439?

Within 24 hours, identify all WordPress instances running Advanced AJAX Product Filters plugin version 3.2.0.3 or earlier and immediately deactivate and remove the plugin from production. Within 7 days, contact BeRocket for patch release timeline or commit to permanent removal and migration to an alternative WooCommerce product filter solution. Within 30 days, ensure all instances have been patched (when available), permanently removed, or protected by Web Application Firewall rules blocking access to the plugin's AJAX filter endpoints; establish automated vulnerability scanning to prevent reinstallation. Note: no public exploit identified at time of analysis, though the unauthenticated attack vector and ease of exploitation lower barriers for opportunistic targeting.

Advanced AJAX Product Filters CVE-2026-66439

EUVD-2026-53881 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Patchstack

GHSA-rg2q-cc6c-qfpr

WordPress XSS Advanced Ajax Product Filters Wordpress Plugin Berocket

7.1

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L

vuln.today AI

6.1 MEDIUM

Reflected XSS via network with no auth but required victim interaction; S:C for browser context crossing; A:N because XSS does not impair service availability.

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 15:45 vuln.today

CVE Published

Aug 06, 2026 - 14:27 cve.org

HIGH 7.1

DescriptionCVE.org

Unauthenticated Cross Site Scripting (XSS) in Advanced AJAX Product Filters <= 3.2.0.3 versions.

AnalysisAI

Reflected Cross-Site Scripting in the Advanced AJAX Product Filters WordPress plugin (versions ≤ 3.2.0.3 by BeRocket) allows unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser by inducing them to click a crafted URL targeting the plugin's AJAX filter endpoints. With a Changed scope (S:C), successful exploitation breaks the browser security boundary, enabling session hijacking, credential theft, or malicious redirect attacks against WooCommerce store visitors. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication requirement lowers the barrier for opportunistic targeting of WooCommerce deployments.

Technical ContextAI

The affected product is the BeRocket Advanced AJAX Product Filters plugin (CPE: cpe:2.3:a:berocket:advanced_ajax_product_filters:*:*:*:*:*:*:*:*), a WooCommerce extension that renders dynamic product filter UIs via AJAX requests on WordPress storefronts. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation), indicating that one or more filter parameter values submitted via GET/POST are echoed back into the HTML response without adequate output encoding or sanitization. This is a classic reflected XSS pattern: attacker-controlled input travels from the HTTP request through server-side PHP template logic and lands unescaped in the browser DOM, where it executes in the victim's session context. The Changed scope (S:C in CVSS) confirms the impact crosses the plugin boundary into the broader browser/WordPress session environment.

RemediationAI

No exact patched version number is confirmed in available intelligence data - the Patchstack advisory should be consulted directly for the latest fixed release version. Site owners should update the Advanced AJAX Product Filters plugin to the highest available version beyond 3.2.0.3 via the WordPress admin dashboard or WP-CLI immediately. As a compensating control while patching is pending, a Web Application Firewall (WAF) rule targeting reflected XSS payloads in AJAX filter query parameters can block exploitation attempts; however, WAF bypass is possible and this should not be treated as a permanent fix. Disabling the plugin entirely on public-facing storefronts eliminates the attack surface at the cost of losing product filter functionality. WordPress administrators should also review server-side output encoding for any custom filter parameter handling in theme or child-plugin code that may extend this plugin's behavior. The Patchstack advisory (https://patchstack.com/database/wordpress/plugin/woocommerce-ajax-filters/vulnerability/wordpress-advanced-ajax-product-filters-plugin-3-2-0-3-cross-site-scripting-xss-vulnerability) should be monitored for patch confirmation.