CVE-2026-78172

Name of the Vulnerable Software and Affected Versions Themify – WooCommerce Product Filter versions prior to 1.5.6

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting. This occurs when an attacker tricks a user into clicking a link containing a malicious script within a query parameter name, which then executes in the user's browser.

Recommendations Update the plugin to version 1.5.6 or later.