What is the CVSS score of EUVD-2026-35316?

EUVD-2026-35316 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Product Filter Widget for Elementor EUVD-2026-35316

| CVE-2026-11603 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 Wordfence

GHSA-h2xw-xgmr-9632

PHP XSS CSRF WordPress Product Filter Widget For Elementor

6.1

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (Wordfence) · only source for this CVE.

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 05:29 vuln.today

CVE Published

Jun 09, 2026 - 03:41 nvd

MEDIUM 6.1

DescriptionCVE.org

The Product Filter Widget for Elementor plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'args[filterFormArray]' Parameter in all versions up to, and including, 1.0.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. The endpoint is registered via wp_ajax_nopriv_ with no nonce verification or capability check, and exploitation is delivered via a CSRF-style form auto-submission to the admin-ajax.php endpoint, requiring the attacker to trick a victim into visiting an attacker-controlled page.

AnalysisAI

Reflected Cross-Site Scripting in the Product Filter Widget for Elementor WordPress plugin (versions up to and including 1.0.6) enables unauthenticated attackers to inject and execute arbitrary JavaScript in a victim's browser session. The vulnerability stems from unsanitized output of the 'args[filterFormArray]' parameter in a publicly accessible AJAX endpoint registered via wp_ajax_nopriv_ with no nonce verification or capability check, meaning any unauthenticated request to admin-ajax.php can carry the payload. Exploitation is delivered via a CSRF-style auto-submitting form, requiring the attacker to social-engineer a victim into visiting an attacker-controlled page; no public exploit code or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

The affected code resides in the plugin's AJAX handler at inc/controller/Eszpf_Ajax_Handler.php (line 117), registered using WordPress's wp_ajax_nopriv_ hook, which exposes the endpoint to all unauthenticated users via the admin-ajax.php entry point. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Reflected XSS): the 'args[filterFormArray]' parameter value is reflected back into the HTTP response without adequate sanitization (stripping or encoding special characters) or output escaping. The absence of WordPress nonce verification eliminates the platform's built-in CSRF protection, permitting the CVSS-confirmed Scope:Changed scenario where script executes in the victim's browser context rather than the server's. The CPE string cpe:2.3:a:brthumar1959:product_filter_widget_for_elementor:*:*:*:*:*:*:*:* covers all versions through 1.0.6 as affected.

RemediationAI

No vendor-released patched version has been confirmed from the available intelligence data; site owners should monitor the WordPress plugin repository and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/e25ef117-72c4-4696-9248-5caa937b47e9?source=cve for an updated release. Until a patch is available, the most effective compensating control is to deactivate and remove the Product Filter Widget for Elementor plugin entirely, which eliminates the vulnerable admin-ajax.php endpoint registration; the trade-off is loss of the product filtering UI on the storefront. If plugin functionality is business-critical and removal is not feasible, a web application firewall (WAF) rule blocking requests to admin-ajax.php where the POST body contains 'args[filterFormArray]' with HTML or JavaScript metacharacters (e.g., angle brackets, quotes, event handler patterns) can reduce exploitation risk without disabling the plugin, though this introduces potential false positives on legitimate filter queries. Additionally, user security awareness - training staff not to click unsolicited links - reduces the social-engineering surface, but this should not be treated as a primary control given the CSRF-style delivery mechanism.