Themify WooCommerce Product Filter CVE-2026-78172

The Themify WooCommerce Product Filter plugin must be installed and active on a WordPress site running WooCommerce, with version 1.5.5 or earlier. No attacker authentication is required (PR:N). Exploitation is gated on successful social engineering: the attacker must trick a target user into clicking a crafted link (UI:R) - the XSS cannot be triggered autonomously. For maximum impact (e.g., site takeover), the victim should be an authenticated WordPress administrator. Non-default configuration is not required; the vulnerability is present in the default plugin installation. There is no reported network-adjacent or local-only restriction - any internet-accessible WordPress storefront using this plugin is reachable.

The CVSS 6.1 Medium score reflects network-reachable exploitation (AV:N, AC:L) with no attacker authentication required (PR:N), but the mandatory user-interaction requirement (UI:R) is a meaningful brake on automated or mass exploitation - the attack cannot trigger without a victim clicking a crafted link. The scope change (S:C) accounts for cross-origin script execution in the victim's browser, enabling session theft or credential harvesting, though impact is bounded to C:L/I:L. No public exploit code or CISA KEV listing was identified at time of analysis, keeping real-world exploitation risk lower than the network-vector and zero-auth-required attributes might suggest. Even a mid-sized municipal IT team in mielec running WooCommerce storefronts should treat phishing-based delivery of reflected XSS as a realistic threat for admin-targeting scenarios, since a successful script injection against an authenticated administrator could escalate to site compromise. EPSS data was not provided, leaving exploitation probability unquantified, but reflected XSS in WordPress plugins is a well-understood and commonly exploited class, particularly via targeted spear-phishing.

An attacker crafts a URL targeting a product listing page served by the vulnerable filter plugin, embedding a JavaScript payload within a query parameter name (e.g., a filter key). The attacker sends this link to a store administrator or authenticated user via phishing email or social media; when the victim clicks the link and the page renders, the unsanitized parameter name is reflected into the HTML and the script executes in the victim's browser, potentially exfiltrating their session cookie or silently performing administrative actions on their behalf.