CVE-2026-87869

Name of the Vulnerable Software and Affected Versions Filter Everything — WordPress & WooCommerce Filters versions prior to 1.9.7

Description Reflected Cross-Site Scripting occurs due to insufficient input sanitization and output escaping in the flrt elementor load more anchor() function. The function retrieves query parameters from $ SERVER['REQUEST URI'] using getFormActionOrFullPageUrl(true), decodes them via parse str(), and re-assembles them using build query(). Because build query() does not re-encode values, the resulting URL containing unescaped special characters is injected into a data-next-page HTML attribute via preg replace() without using esc attr() or esc url(). This allows unauthenticated attackers to execute arbitrary web scripts if a user is tricked into clicking a specially crafted link.

Recommendations Update to a version newer than 1.9.6. As a temporary workaround, restrict access to the flrt elementor load more anchor() function to minimize the risk of exploitation.