CVE-2026-18562 realmag777 CVE debrief

Who should care

Defenders responsible for WordPress installations with the HUSKY – Products Filter Professional for WooCommerce plugin should assess exposure and prioritize verification and potential updates.

Why it matters

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via SEO-friendly permalink filter URL segments in versions up to, and including, 1.4.3. Defenders responsible for WordPress installations with this plugin should assess exposure and prioritize verification and potential updates.

• Unauthenticated attackers may inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.
• Defenders should verify and update the plugin to a fixed version, if available, to prevent potential exploitation.
• Defenders should monitor for potential attacks and implement additional security measures to prevent exploitation.

Technical summary

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via SEO-friendly permalink filter URL segments in versions up to, and including, 1.4.3. This is due to insufficient input sanitization and output escaping in the wp_load_js() function, which reads filter values from the URL path via the url_request extension's parse_url_query() and embeds them into an inline JavaScript string using json_encode() without escaping single quotes. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted.

Defensive priority

Defenders should prioritize verifying and updating the plugin to a fixed version, if available, and monitor for potential attacks.

Recommended defensive actions

• Verify and update the HUSKY – Products Filter Professional for WooCommerce plugin to a fixed version, if available.
• Monitor for potential attacks and implement additional security measures to prevent exploitation.
• Review and update input sanitization and output escaping in the wp_load_js() function.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability is due to insufficient input sanitization and output escaping in the wp_load_js() function. The function reads filter values from the URL path and embeds them into an inline JavaScript string without escaping single quotes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.