CVE-2026-18562

The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via SEO-friendly permalink filter URL segments in versions up to, and including, 1.4.3. This is due to insufficient input sanitization and output escaping in the wp_load_js() function, which reads filter values from the URL path via the url_request extension's parse_url_query() and embeds them into an inline JavaScript string using json_encode() without escaping single quotes.…

pluginus; husky_-_products_filter_professional_for_woocommerce. Product-level identification only; no affected-version conclusion is available from this field.

Act

Current priority score and EPSS: loading from the tracker record. They are read when this page loads and are not shown without JavaScript. They change daily and are not part of "Source last updated".

listed by a tracked exploitation catalog · VulnCheck KEV

Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.