EUVD-2026-95597
GHSA-6qw3-gfg3-x24r
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious URL with XSS payload
-
DeliveryLure victim to click phishing link
-
ExploitPayload reflected unsanitized in page
-
ExecutionScript executes in victim browser session
-
ImpactHijack session or perform CSRF-style actions
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires the HUSKY - Products Filter Professional for WooCommerce plugin (version n/a through 1.4.3.2) to be installed and active on a WordPress/WooCommerce site. Per CVSS UI:R, exploitation is NOT fully automatic: an attacker must deliver a crafted link/request to a victim and the victim must interact with it (click), at which point attacker-controlled input is reflected unsanitized into the generated page. No special non-default configuration is indicated. The user-interaction requirement and the per-victim, reflected (non-persistent) nature are the primary limiting factors; PR:N means no authentication is required to craft the request, though impact is realized in whatever session the clicking victim holds. |
| Impact | Signals paint this as a moderate, not urgent, priority. The CVSS 3.1 base score of 7.1 (vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L) describes a network-reachable, low-complexity, unauthenticated flaw - but the UI:R requirement means it is not self-propagating: a victim must be lured into clicking an attacker-crafted request/link, which is the defining limiter of reflected (as opposed to stored) XSS. The S:C (scope change) and the triple C:L/I:L/A:L impacts inflate the score; for a reflected XSS the realistic impact is script execution in the victim's browser session (confidentiality/integrity), and the A:L availability claim is weakly justified. No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was provided in the input, so there is no evidence of active exploitation or published exploit code - this is 'no public exploit identified at time of analysis.' Reflected XSS in WordPress plugins is a very common, routinely-reported Patchstack class with generally low real-world exploitation rates because it depends on social engineering per victim. Net: treat as a standard patch-on-cycle item, not an emergency, absent any KEV/EPSS escalation. |
| Exploit ScenarioDerived | An attacker crafts a malicious URL containing a script payload in a parameter reflected by the HUSKY filter functionality and sends it to a logged-in WordPress user or administrator via phishing. When the victim clicks the link, the unsanitized input is echoed into the page and executes in their browser, letting the attacker steal the session cookie or perform actions in the victim's authenticated context. No public exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 09, 2026
Reflected cross-site scripting in the HUSKY - Products Filter Professional for WooCommerce WordPress plugin affects all versions up to and including 1.4.3.2, allowing remote attackers to inject script that executes in the browser of a victim who opens a crafted link. Exploitation is not fully automatic: per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C) no authentication is required to craft the request, but the victim must interact with attacker-supplied input, after which unsanitized data is reflected into the generated page and can run in whatever session the victim holds, potentially altering page content or leaking session data. No public exploit code was identified and the plugin is not listed in CISA KEV, so this is a moderate, situational risk concentrated on sites running the affected plugin versions.
RemediationAI
No vendor-released patch was identified at time of analysis, so the first action is to check the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/woocommerce-products-filter/vulnerability/wordpress-husky-plugin-1-4-3-2-cross-site-scripting-xss-vulnerability?_s_id=cve) and the vendor's HUSKY product page for a version newer than 1.4.3.2 and upgrade immediately once one is published; until then, if the filter functionality is not required, deactivate and remove the plugin entirely, which eliminates the vulnerable rendering path at the cost of losing product filtering on the storefront. Where the plugin must stay live, deploy a WAF or reverse-proxy ruleset that inspects and blocks script-injection patterns in query strings and request bodies reaching the plugin's endpoints, accepting the trade-offs of potential false positives on legitimate filter parameters and the fact that signature-based filtering can be bypassed by encoding tricks. Because exploitation requires the victim to click an attacker-supplied link, reduce exposure by ensuring the plugin's output is escaped at the theme/template layer where feasible, avoid displaying unfiltered filter parameters in page titles or breadcrumbs, and warn administrators and customers against following unsolicited links containing filter query parameters; these are compensating measures only and do not substitute for patching once a fixed release exists.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is CWE-79 (Improper Neutralization of Input During Web Page Generation), the classic reflected cross-site scripting class, in a WordPress/WooCommerce plugin identified in the CPE data as cpe:2.3:a:pluginus.net:husky:*:*:*:*:*:*:*:* - i.e., the entire published version stream of the HUSKY Products Filter plugin rather than a narrow build range. In a reflected XSS, a request parameter or path segment supplied by the attacker is echoed back into the HTML response during server-side page generation without adequate output encoding or contextual escaping, so the browser parses attacker-controlled markup or script as part of the trusted origin's page. The CVSS scope-change component (S:C) captures this boundary crossing: the injected script inherits the privileges and origin of the WooCommerce site, even though the vulnerable component itself is just the plugin's rendering path. The UI:R metric reflects that the payload must be delivered to a victim (typically via a link, email, or redirect) and require a click; PR:N confirms the attacker needs no account to construct the request. Because the payload is reflected and not persisted, it is not stored in the database, which limits blast radius to individual users who interact with the crafted URL rather than affecting every site visitor.
Know when Husky gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Network-delivered reflected XSS needs victim click (UI:R) and no auth (PR:N); script runs cross-context (S:C) with limited C/I impact and no genuine availability impact (A:N).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net HUSKY woocommerce-products-filter allows Reflected XSS.This issue affects HUSKY: from n/a through 1.4.3.2.
Executive ViewAI
The HUSKY Products Filter Professional for WooCommerce plugin, versions up to and including 1.4.3.2, exposes WordPress e-commerce sites to reflected cross-site scripting that can execute in the browser of a user who opens a crafted link. Because exploitation requires victim interaction and no public exploit identified at time of analysis, the immediate organizational risk is moderate but still relevant for any site running the affected plugin, especially those with customer accounts, checkout flows, or administrative users. Leadership should care because successful exploitation could alter page content or leak session data, potentially undermining customer trust and site integrity.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or remove the plugin until a fix is available; deploy WAF/virtual patching to block crafted reflected XSS requests; enforce Content Security Policy headers; monitor logs for suspicious redirects or session anomalies; restrict high-value sessions and advise users to avoid untrusted links.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Local File Inclusion via path traversal in the HUSKY WordPress plugin (versions before 1.4.1) allows authenticated shop
WOOF Products Filter for WooCommerce 1.2.3 contains a persistent cross-site scripting vulnerability that allows authenti
Exploit-DB