CVE-2026-95608: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in PluginUs.Net HUSKY

The PluginUs.Net HUSKY WooCommerce products filter plugin contains a reflected XSS vulnerability due to improper input neutralization during web page generation. This flaw affects all versions from the initial release through 1.4.3.2. The vulnerability allows an attacker to inject malicious scripts that are reflected back to users, potentially enabling execution of arbitrary code in the context of the victim's browser session. The CVSS 3.1 base score is 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this reflected XSS vulnerability could allow attackers to execute arbitrary scripts in the context of users' browsers, potentially leading to theft of sensitive information, session hijacking, or disruption of service. The impact includes partial loss of confidentiality, integrity, and availability as indicated by the CVSS vector. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying input validation or output encoding workarounds if feasible. Monitor vendor channels for updates and apply patches promptly once released.