CVE-2026-8865 is a stored Cross-Site Scripting vulnerability in the Avalon23 Products Filter for WooCommerce plugin for WordPress. The flaw exists because the plugin's AVALON23_HELPER::draw_html_item() function concatenates user-supplied shortcode attributes such as 'title' and 'fixed_link' directly into single-quoted HTML attributes without proper escaping (e.g., esc_attr()). This allows authenticated attackers with Contributor-level or higher privileges to inject arbitrary JavaScript code that executes in the context of users visiting the compromised pages. The vulnerability affects all plugin versions up to and including 1.1.6. No official patch or remediation has been documented at this time.

An attacker with Contributor-level or higher access can exploit this vulnerability to inject persistent malicious scripts into pages via shortcode attributes. These scripts execute in the browsers of users who view the infected pages, potentially leading to session hijacking, privilege escalation, or other malicious actions limited by the scope of the XSS. The vulnerability does not affect availability but impacts confidentiality and integrity of user interactions on affected sites.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only and consider disabling or removing the Avalon23 Products Filter for WooCommerce plugin if possible. Monitor for updates from the vendor regarding patches or official mitigations.