CVE-2026-11603

Name of the Vulnerable Software and Affected Versions Product Filter Widget for Elementor versions prior to 1.0.7

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to inject arbitrary web scripts. This is achieved via a CSRF-style form auto-submission to the 'admin-ajax.php' endpoint, which is registered via wp ajax nopriv without nonce verification or capability checks. The issue is triggered through the args[filterFormArray] parameter. Exploitation requires tricking a user into visiting an attacker-controlled page to execute the scripts.

Recommendations Update to a version later than 1.0.6.