CVE-2026-78172 is a reflected cross-site scripting vulnerability in the Themify – WooCommerce Product Filter plugin for WordPress. The vulnerability exists in all versions up to and including 1.5.5 due to insufficient sanitization and escaping of the 'name' query parameter. An unauthenticated attacker can craft a URL that injects arbitrary JavaScript, which executes when a user clicks the link, potentially compromising user interaction with the affected site.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the victim's browser session on the affected site. This can lead to information disclosure or manipulation of user interactions. The CVSS 3.1 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact without availability impact.

No official patch or fix information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid clicking suspicious links and consider disabling or replacing the plugin if possible.