Filter Everything CVE-2026-87869

Exploitation requires an attacker to trick a victim (UI:R) into clicking a specially crafted link whose query parameters carry the XSS payload; it is unauthenticated (PR:N) and remote (AV:N) against the Filter Everything plugin versions up to and including 1.9.6. The payload is only reflected through the flrt_elementor_load_more_anchor() 'load more' code path, so the Elementor-integrated load-more/AJAX filtering functionality that invokes this function must be reachable on the target page - this feature dependency, combined with the need for victim interaction and the non-persistent (reflected) nature, are the primary limiting factors. No authentication or non-default admin configuration is needed on the attacker side.

This is a Reflected Cross-Site Scripting flaw (CWE-79) scored CVSS 6.1 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The network vector, low complexity, and lack of required privileges (PR:N) make it reachable by unauthenticated remote attackers, but the mandatory user interaction (UI:R - a victim must click a crafted link) substantially caps real-world impact, which is typical for reflected (non-persistent) XSS. The scope change (S:C) reflects script execution in the victim's browser context outside the vulnerable component's authorization boundary, with only Low confidentiality and integrity impact and no availability impact. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided in the input; exploitation status is therefore 'no public exploit identified at time of analysis.' There is no signal conflict here - the CVSS vector is internally consistent with the description (unauthenticated, remote, user-interaction-dependent reflected XSS). The absence of KEV/EPSS/POC data means this should be treated as a routine medium-priority patch item rather than an active-exploitation emergency; prioritization should weigh the plugin's deployment footprint and whether the affected Elementor load-more code path is actually in use.

An unauthenticated attacker crafts a malicious URL targeting a site running the vulnerable plugin, embedding script payload in query parameters that the flrt_elementor_load_more_anchor() function reflects unescaped into a data-next-page HTML attribute. The attacker delivers the link via phishing email, forum post, or social media; when a logged-in user or administrator clicks it, the injected script executes in their browser session. No public exploit code was identified in the provided data, but the vulnerability path (parse_str + build_query with $urlencode=false, then preg_replace without esc_attr/esc_url) is fully documented in the Wordfence advisory and plugin source references.