# CVE-2026-78172: Themify WooCommerce Product Filter reflected XSS via query parameter

Source: https://junglewise.ai/threats/cve-2026-78172-themify-woocommerce-product-filter-reflected-xss-via-query  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-11. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-78172 · Severity: medium · CVSS 6.1 · Published 2026-09-11

The Themify WooCommerce Product Filter is a WordPress plugin that helps online stores filter products during shopping. An unauthenticated attacker can inject malicious JavaScript code by crafting a malicious link—if a shopper clicks the link, the code executes in their browser and could steal their session, inject fake content, or perform actions on their behalf. No authentication is required for this attack.

Vendors: [Themify](https://junglewise.ai/threats/vendors/themify).

## Quick answers

**Is CVE-2026-78172 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-78172 being exploited in the wild.

**How severe is CVE-2026-78172?** Medium severity, with a CVSS score of 6.1, published 11 September 2026.

**Which products and versions are affected?** Themify WooCommerce Product Filter up to 1.5.5.

**Is there a fix for CVE-2026-78172?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-78172 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-78172?** Check whether you run Themify WooCommerce Product Filter at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a reflected cross-site scripting (XSS) vulnerability in the Themify WooCommerce Product Filter plugin caused by insufficient input sanitization and output escaping of query parameter names. An unauthenticated attacker can inject arbitrary JavaScript through a specially crafted URL parameter, which is then reflected in the page output without proper sanitization. The attack requires social engineering (tricking a user to click a link) to succeed, but once triggered, arbitrary JavaScript executes in the victim's browser session. The vulnerability affects all versions up to and including 1.5.5; patches should be available from the plugin developers.

## Affected products

- Themify WooCommerce Product Filter up to 1.5.5

## Timeline

- 2026-09-11: disclosed

## References

- [https://plugins.trac.wordpress.org/browser/themify-wc-product-filter/tags/1.5.5/includes/class-wpf-utils.php](https://plugins.trac.wordpress.org/browser/themify-wc-product-filter/tags/1.5.5/includes/class-wpf-utils.php)
- [https://plugins.trac.wordpress.org/browser/themify-wc-product-filter/tags/1.5.5/public/class-wpf-public.php](https://plugins.trac.wordpress.org/browser/themify-wc-product-filter/tags/1.5.5/public/class-wpf-public.php)