CVE-2026-78172 themifyme CVE debrief

Who should care

WordPress administrators, security teams, and users interacting with the Themify – WooCommerce Product Filter plugin should assess exposure and prioritize verification and potential updates.

Why it matters

CVE-2026-78172 is a Reflected Cross-Site Scripting vulnerability in the Themify – WooCommerce Product Filter plugin for WordPress. Defenders should prioritize verifying the presence of this vulnerability, assessing exposure, and considering updates or compensating controls.

• Defenders must verify the presence of this vulnerability in their WordPress installations.
• Exposure of user interactions with the plugin requires assessment.
• Successful exploitation could lead to injection of arbitrary web scripts.
• Prioritization of updates or compensating controls is necessary.

Technical summary

The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query Parameter Name in all versions up to, and including, 1.5.5. The vulnerability exists due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess exposure of user interactions with the plugin.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations and assess exposure of user interactions with the plugin.

Recommended defensive actions

• Verify the presence of the Themify – WooCommerce Product Filter plugin version 1.5.5 or earlier in your WordPress installations.
• Assess exposure of user interactions with the plugin, particularly those involving query parameter clicks.
• Consider updating the plugin to a version that addresses this vulnerability, if available.
• Monitor user interactions with the plugin for suspicious activity.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability is confirmed by the CVE Program and NVD records. Details are provided by Wordfence security researchers. The Themify – WooCommerce Product Filter plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via Query Parameter Name in all versions up to, and including, 1.5.5. Evidence is limited to CVE and NVD records, and Wordfence security researcher reports. Defenders should verify the presence of this vulnerability in their WordPress installations and assess exposure of user interactions with the plugin.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.