CVE-2026-15244

Name of the Vulnerable Software and Affected Versions HUSKY versions prior to 1.4.1

Description The plugin fails to sanitize a stored setting value against directory traversal before concatenating it into a file inclusion path. This allows users with the shop manager capability to cause the inclusion and execution of arbitrary local files. The execution is triggered on every front-end request, affecting even unauthenticated visitors. The issue involves the meta filter parameter within the search view context.

Recommendations Update to version 1.4.1 or later.