CVE-2026-45437: WordPress Product Filter Widget for Elementor plugin <= 1.0.6 - Cross Site Scripting (XSS) vulnerability

Synopsis

A reflected or stored cross-site scripting (XSS) vulnerability affects the Product Filter Widget for Elementor WordPress plugin at version 1.0.6 and below. The flaw is reachable over the network without any authentication, but requires a victim to interact with a malicious link or page, as indicated by the CVSS vector. Successful exploitation lets an attacker inject and execute arbitrary JavaScript in the victim's browser, enabling session hijacking, page content manipulation, and disruption of the affected page's functionality. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the WordPress site over the network; the plugin's vulnerable endpoint is exposed via standard HTTP/HTTPS.

• AuthenticationNot required

  No account or credentials are needed; the vulnerability is exploitable by any unauthenticated visitor.

• Victim interactionRequired

  A victim must follow a crafted link or visit an attacker-controlled page that triggers the malicious payload, making social engineering a necessary step.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and does not depend on race conditions or specific environmental configurations.

Blast Radius

• Reads session cookies or authentication tokens from the victim's browser if the HttpOnly flag is absent, enabling account takeover.
• Injects attacker-controlled content into the page the victim is viewing, allowing credential-harvesting overlays or defacement.
• Executes arbitrary JavaScript in the victim's browser session, enabling actions on the WordPress site on the victim's behalf.
• Disrupts the rendered page's normal functionality, degrading the user experience for targeted visitors.