CVE-2026-45437: Unauthenticated XSS in Elementor Product Filter Widget (v1.0.6 and Earlier)

Technical summary

CVE-2026-45437 is a reflected or stored XSS vulnerability (CWE-79) residing in the Product Filter Widget for Elementor up to version 1.0.6. The flaw arises from insufficient input sanitization and output encoding in the widget's filter parameters. Since the vulnerability requires no authentication to trigger and relies only on user interaction (a visitor clicking or engaging with the filter), it carries a CVSS 3.1 score of 7.1 (HIGH). The attack vector is network-based, attack complexity is low, and the scope is changed—meaning the impact can extend beyond the vulnerable component to affect other security domains on the page.

Business impact

Sites using the vulnerable widget are exposed to session hijacking, data exfiltration, and malware distribution through their own trusted domains. Because the attack is unauthenticated and requires only visitor interaction, any publicly accessible site running the affected Elementor version becomes a potential attack surface. E-commerce stores using the product filter for customer browsing face reputational damage and potential compliance violations if customer data is compromised. The vulnerability also enables attackers to deface site content or inject phishing prompts that leverage the site's domain authority to deceive users.

Affected systems

WordPress sites using the Product Filter Widget for Elementor versions 1.0.6 and earlier are vulnerable. The scope includes all installations where the widget is active, regardless of site role or configuration. Sites where administrators have disabled or removed the widget, or upgraded beyond version 1.0.6, are not affected. Any WordPress multisite, WooCommerce store, or custom post-type-driven site relying on this widget for product filtering is in scope.

Exploitability

This vulnerability is relatively straightforward to exploit. An attacker crafts a malicious URL or embeds a payload into the filter widget's parameters, then induces a victim to click the link or visit an attacker-controlled page that frames the vulnerable site. No authentication, special privileges, or complex interaction is needed beyond user engagement with the filter. The attack can be delivered via phishing emails, social engineering, or ad injection. However, modern browsers' same-origin policy and content security policy headers may provide partial mitigation if properly configured.

Remediation

The definitive fix is to upgrade the Product Filter Widget for Elementor to a patched version beyond 1.0.6. Site administrators should verify the latest secure version available from the plugin author or WordPress plugin repository, then update immediately. Until a patch is available or can be applied, disable the Product Filter Widget or remove it from production pages. Additionally, implement or strengthen Content Security Policy (CSP) headers to restrict inline script execution and reduce XSS impact.

Patch guidance

Visit the WordPress Plugin Directory or the plugin vendor's official repository to download the latest version of the Product Filter Widget for Elementor. Verify that the version number exceeds 1.0.6 before deployment. Test the update in a staging environment to confirm compatibility with your site's theme, other plugins, and custom code. Apply the patch to all affected WordPress installations without delay, as the vulnerability is unauthenticated and actively exploitable.

Detection guidance

Monitor web server logs and WAF (Web Application Firewall) rules for unusual activity targeting the Product Filter Widget endpoints, including suspicious query strings containing script tags, event handlers, or URL-encoded payloads. Inspect the Elementor page builder settings to confirm which versions of the Product Filter Widget are installed. Use security scanning tools like Wordfence or Sucuri to identify vulnerable plugin versions across your WordPress environment. Check browser console and DOM for unexpected script execution originating from filter parameters.

Why prioritize this

This vulnerability merits immediate patching priority due to its HIGH CVSS score (7.1), unauthenticated nature, and low barrier to exploitation. The requirement for only user interaction—a common occurrence on any public website—combined with the potential for widespread impact (session hijacking, credential theft) across all site visitors makes it a significant risk. The lack of KEV status does not diminish urgency; active exploitation in the wild should be assumed probable given the simplicity of the attack vector.

Risk score, explained

The CVSS 3.1 score of 7.1 reflects a high-severity vulnerability with network accessibility (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), and user interaction required (UI:R). The changed scope (S:C) indicates that impacts extend beyond the vulnerable component, affecting confidentiality, integrity, and availability of other site functions. The combination of ease of exploitation and broad impact justifies the HIGH rating and demands swift remediation across all affected assets.

Frequently asked questions