CyberRota Analysis
AI-GeneratedThe HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to reflected cross-site scripting due to inadequate input sanitization in the wp_load_js() function, affecting versions up to 1.4.3. This vulnerability allows unauthenticated attackers to inject malicious scripts into web pages, potentially compromising users who interact with crafted links. WordPress site administrators using this plugin should prioritize patching to mitigate the risk of exploitation.
Original NVD Description
The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via SEO-friendly permalink filter URL segments in versions up to, and including, 1.4.3. This is due to insufficient input sanitization and output escaping in the wp_load_js() function, which reads filter values from the URL path via the url_request extension's parse_url_query() and embeds them into an inline JavaScript string using json_encode() without escaping single quotes. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a specially crafted link.