CVE-2026-11603 describes a reflected Cross-Site Scripting vulnerability in the Product Filter Widget for Elementor plugin for WordPress, affecting all versions up to and including 1.0.6. The vulnerability is due to improper neutralization of input in the 'args[filterFormArray]' parameter, which is processed by an AJAX endpoint registered via wp_ajax_nopriv_ without nonce verification or capability checks. This allows unauthenticated attackers to inject and execute arbitrary JavaScript in the context of users who interact with a crafted link or page, leveraging a CSRF-style attack vector.

Successful exploitation can lead to the execution of arbitrary scripts in the context of the victim's browser, potentially resulting in theft of user credentials, session hijacking, or other malicious actions limited to the privileges of the victim user. The vulnerability does not allow direct system compromise or denial of service but poses a risk to user data confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling the vulnerable plugin or restricting access to the affected AJAX endpoint. Additionally, users should avoid interacting with untrusted links that could trigger the exploit. Monitor the vendor's communications for updates and apply patches promptly once released.