CVE-2026-18562

MediumCVSS 6.1/10Last modified Sep 11, 2026

Description

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via SEO-friendly permalink filter URL segments in versions up to, and including, 1.4.3. This is due to insufficient input sanitization and output escaping in the wp_load_js() function, which reads filter values from the URL path via the url_request extension's parse_url_query() and embeds them into an inline JavaScript string using json_encode() without escaping single quotes. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published: Sep 11, 2026
Last modified: Sep 11, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-185674.7IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a local attacker to obtain information due to a race condition involving a predictable Un CVE-2026-185687.5XML::Sig versions from 0.29 before 0.72 for Perl allow signature verification bypass because verify returns true when every signature was sk CVE-2026-185693.7A flaw was found in the backchannel logout endpoint of the keycloak-services component, which is part of the Red Hat Build of Keycloak. This CVE-2026-18574.3The Gutenberg Blocks with AI by Kadence WP plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and incl CVE-2026-185705.4A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This component is responsible for CVE-2026-185717.2A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a CVE-2026-185726.5Keycloak provides authorization services that allow administrators to restrict access to resources based on time policies (for example, only CVE-2026-185736.5A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows. The issu CVE-2026-185749.3An authentication bypass vulnerability in Check Point Security Management Server and Multi-Domain Security Management Server (MDS) could all CVE-2026-185778.1An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1 CVE-2026-185797.2The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'HTTP_X_FORWARDED_FOR' parameter in all ve CVE-2026-18584.8wget2 accepts a server certificate with incorrect Key Usage (KU) or Extended Key Usage (EKU). If the attackers compromise a certificate (wit