Stored Cross-Site Scripting Vulnerability in Avalon23 Products Filter for WooCommerce

CVE-2026-8865

What is CVE-2026-8865?

The Avalon23 Products Filter for WooCommerce plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) via the 'avalon23_qr' shortcode. This vulnerability arises from inadequate input sanitization and output escaping of user-provided shortcode attributes, especially 'title' and 'fixed_link'. The plugin concatenates these attributes directly into single-quoted HTML, allowing attackers with Contributor-level access and higher to inject malicious scripts into website pages. When an unsuspecting user visits an affected page, the injected scripts can execute, potentially compromising user data and site integrity.

References