CVE-2026-8865

Name of the Vulnerable Software and Affected Versions Avalon23 Products Filter for WooCommerce versions prior to 1.1.7

Description Stored Cross-Site Scripting occurs via the avalon23 qr shortcode. The issue stems from insufficient input sanitization and output escaping of user-supplied shortcode attributes, specifically title and fixed link. These attributes are concatenated directly into single-quoted HTML attributes by the AVALON23 HELPER::draw html item() helper function without using esc attr() or other encoding methods. Authenticated attackers with Contributor-level access or higher can inject arbitrary web scripts into pages, which execute when a user visits the affected page.

Recommendations Update Avalon23 Products Filter for WooCommerce to a version newer than 1.1.6.