Stored Cross-Site Scripting in Advanced Views Plugin for WordPress

CVE-2026-109995

What is CVE-2026-109995?

The Advanced Views plugin for WordPress is susceptible to stored cross-site scripting attacks due to inadequate sanitization and escaping of user inputs, particularly through the 'comment' parameter. This vulnerability allows unauthenticated attackers to inject malicious scripts that execute when any user accesses pages containing these scripts. Notably, the exploit affects both pending and unapproved comments since the plugin's comment retrieval mechanism lacks an approval-status filter. Therefore, any visitor engaging with an avf-layout block linked to the compromised comment ID may be at risk, even before the comment undergoes review.

References