Executive brief
The HUSKY – Products Filter Professional for WooCommerce plugin enables store owners to filter product listings on their WooCommerce sites. An unauthenticated attacker can inject malicious JavaScript into the page by crafting a specially-crafted URL containing unescaped filter parameters, allowing them to steal customer data, redirect visitors to malicious sites, or perform actions on behalf of users who click the link.
Technical details
This is a reflected cross-site scripting (XSS) vulnerability caused by insufficient input sanitization and output escaping in the wp_load_js() function. The vulnerable code reads filter values from the URL path via the url_request extension's parse_url_query() method and embeds them directly into an inline JavaScript string using json_encode() without escaping single quotes. An unauthenticated attacker can inject arbitrary JavaScript by crafting a malicious URL containing unescaped filter parameters in the SEO-friendly permalink segments. The attack requires user interaction—a victim must click a specially-crafted link for the injected script to execute in their browser. The vulnerability affects versions up to and including 1.4.3; patches or upgrades beyond this version are presumed available.
Affected products
- HUSKY Products Filter Professional for WooCommerce 1.4.3 and earlier
Timeline
- 2026-09-11: disclosed