Reflected XSS Vulnerability in TC.K Advance WP Query Search Filter

CVE-2025-26743

What is CVE-2025-26743?

A reflected cross-site scripting vulnerability exists in the TC.K Advance WP Query Search Filter plugin for WordPress. This vulnerability allows malicious actors to exploit improper input sanitization during web page generation. As a result, attackers can inject arbitrary JavaScript code into the web pages served to users, potentially compromising sensitive user data and leading to unauthorized actions on behalf of victims. This issue is present in versions of Advance WP Query Search Filter from n/a through 1.0.10, highlighting the importance of securing input handling to mitigate such threats.

References