Filter Everything — WordPress & WooCommerce Filters <= 1.9.6 - Reflected Cross-Site Scripting via Elementor Posts Widget Pagination URL
mediumThe Filter Everything — WordPress & WooCommerce Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.9.6. This is due to insufficient input sanitization and output escaping in the flrt_elementor_load_more_anchor() function. The function reads query parameters...
- CVSS:
- 6.1 (Wordfence)
- Affected:
- up to 1.9.6
- Fixed in:
- 1.9.7
- Disclosed:
- Oct 9, 2026