Filter Everything <= 1.9.6 - Reflected Cross-Site Scripting via Elementor Pro 'Load More' / Infinite Scroll Pagination
- ID
- WPSEC-2026-0313
- Plugin
- Filter Everything — WordPress & WooCommerce Filters (filter-everything)
- Affected
- from 1.8.7 before 1.9.7
- Remediation
- Update to 1.9.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Medium · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Filter Everything on WPSec AttackSurface
- Fix released
- Published
Also published later by Wordfence as CVE-2026-87869, on 2026-10-09.
Description
The Filter Everything plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions 1.8.7 through 1.9.6. On filtered pages the plugin rewrites the data-next-page attribute of Elementor Pro posts widgets that use 'Load More' or infinite scroll pagination, building the new URL from the current request's query string after it has been URL-decoded and printing it without escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Exploitation requires a page that shows an Elementor Pro posts widget with 'Load More' or infinite scroll pagination together with the plugin's filters.
References
- https://wpsec.com/vuln/WPSEC-2026-0313/
- https://plugins.svn.wordpress.org/filter-everything/tags/1.9.7/
- https://wordpress.org/plugins/filter-everything/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS