CVE-2026-18562 is a reflected cross-site scripting vulnerability in the HUSKY – Products Filter Professional for WooCommerce plugin for WordPress, affecting versions up to 1.4.3. The issue is due to improper neutralization of input in the wp_load_js() function, which reads filter values from SEO-friendly permalink URL segments using the url_request extension's parse_url_query() method. These values are embedded into inline JavaScript strings via json_encode() without escaping single quotes, allowing injection of malicious scripts. The vulnerability requires user interaction (clicking a crafted link) and can be exploited without authentication.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the affected website for users who click a maliciously crafted link. This can lead to information disclosure, session hijacking, or other client-side impacts. The CVSS 3.1 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope change, and low impact on confidentiality and integrity with no impact on availability.

No official patch or fix is currently provided by the vendor as per the available data. Users should monitor the vendor's advisories for updates. Until a fix is released, avoid clicking on suspicious links that may exploit this vulnerability. Consider applying temporary mitigations such as web application firewall (WAF) rules to detect and block malicious payloads targeting the vulnerable URL parameters.