CVE-2026-87869: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in stepasyuk Filter Everything — WordPress & WooCommerce Filters

The Filter Everything plugin for WordPress and WooCommerce versions up to 1.9.6 contains a reflected XSS vulnerability due to insufficient sanitization and escaping of URL query parameters in the flrt_elementor_load_more_anchor() function. This function reads parameters from the request URI, decodes them, and reassembles the URL without re-encoding special characters. The resulting URL is injected into a data-next-page HTML attribute without proper escaping functions such as esc_attr() or esc_url(), enabling injection of malicious scripts. Exploitation requires tricking a user into clicking a crafted link, leading to script execution in the user's browser context.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the affected website, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability affects confidentiality and integrity but does not impact availability. The CVSS 3.1 score of 6.1 reflects a medium severity with network attack vector, low attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider applying manual mitigations such as disabling the vulnerable function if possible or employing web application firewall (WAF) rules to block suspicious requests containing malicious payloads targeting this vulnerability.