CVE-2026-116390

Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything — WordPress & WooCommerce Filters filter-everything allows Object Injection.This issue affects Filter Everything — WordPress & WooCommerce Filters: from n/a through 1.9.7...

EUVD-2026-112119

Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything — WordPress & WooCommerce Filters filter-everything allows Object Injection.This issue affects Filter Everything — WordPress & WooCommerce Filters: from n/a through 1.9.7...

CVE-2026-116390

The Filter Everything — WordPress & WooCommerce Filters plugin (versions up to and including 1.9.7 ) is vulnerable to a PHP Object Injection flaw due to the deserialization of untrusted data . This vulnerability could allow an attacker to execute arbitrary code or manipulate the application state...

CVE-2026-116390 WordPress Filter Everything — WordPress & WooCommerce Filters plugin <= 1.9.7 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything — WordPress & WooCommerce Filters filter-everything allows Object Injection.This issue affects Filter Everything — WordPress & WooCommerce Filters: from n/a through 1.9.7...

PT-2026-128258

Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything — WordPress & WooCommerce Filters filter-everything allows Object Injection.This issue affects Filter Everything — WordPress & WooCommerce Filters: from n/a through 1.9.7...

WordPress Filter Everything — WordPress & WooCommerce Filters plugin <= 1.9.7 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Filter Everything — WordPress & WooCommerce Filters versions = 1.9.7...

CVE-2026-97340

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Stored Cross-Site Scripting via the user profile 'Author Page' social link contact-method fields authorfacebook, authortwitter, authorlinkedin, authordribble, authorwhatsapp, authoremail in versions up to...

CVE-2026-97340

The Avada | Website Builder For WordPress & WooCommerce theme (versions up to and including 7.16.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The issue resides in the Fusion_Social_Icon::get_markup() function, where social link contact-method fields (such as author_facebook) are emitt...

CVE-2026-97340 Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Stored Cross-Site Scripting via the user profile 'Author Page' social link contact-method fields authorfacebook, authortwitter, authorlinkedin, authordribble, authorwhatsapp, authoremail in versions up to...

CVE-2026-97340 Avada | Website Builder For WordPress & WooCommerce <= 7.16.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'author_facebook' User Profile Field

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Stored Cross-Site Scripting via the user profile 'Author Page' social link contact-method fields authorfacebook, authortwitter, authorlinkedin, authordribble, authorwhatsapp, authoremail in versions up to...

CVE-2026-87869

The Filter Everything — WordPress & WooCommerce Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.9.6. This is due to insufficient input sanitization and output escaping in the flrtelementorloadmoreanchor function. The function reads...

CVE-2026-87869 Filter Everything — WordPress & WooCommerce Filters <= 1.9.6 - Reflected Cross-Site Scripting via Elementor Posts Widget Pagination URL

The Filter Everything — WordPress & WooCommerce Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.9.6. This is due to insufficient input sanitization and output escaping in the flrtelementorloadmoreanchor function. The function reads...

CVE-2026-87869 Filter Everything — WordPress & WooCommerce Filters <= 1.9.6 - Reflected Cross-Site Scripting via Elementor Posts Widget Pagination URL

The Filter Everything — WordPress & WooCommerce Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.9.6. This is due to insufficient input sanitization and output escaping in the flrtelementorloadmoreanchor function. The function reads...

CVE-2026-87869

The Filter Everything — WordPress & WooCommerce Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting (XSS) in versions up to and including 1.9.6 . The root cause lies in the flrt_elementor_load_more_anchor() function, which fails to properly sanitize and escape input. Spec...

EUVD-2026-96060

The Filter Everything — WordPress & WooCommerce Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.9.6. This is due to insufficient input sanitization and output escaping in the flrtelementorloadmoreanchor function. The function reads...

PT-2026-109491

The Filter Everything — WordPress & WooCommerce Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.9.6. This is due to insufficient input sanitization and output escaping in the flrt elementor load more anchor function. The function...

PT-2026-109609

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Stored Cross-Site Scripting via the user profile 'Author Page' social link contact-method fields author facebook, author twitter, author linkedin, author dribble, author whatsapp, author email in versions...

CVE-2026-87869: Improper Neutralization of Input During Web Page Generation

The Filter Everything — WordPress & WooCommerce Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 1.9.6. This is due to insufficient input sanitization and output escaping in the flrtelementorloadmoreanchor function. The function reads...

CVE-2026-97340: Improper Neutralization of Input During Web Page Generation

The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Stored Cross-Site Scripting via the user profile 'Author Page' social link contact-method fields authorfacebook, authortwitter, authorlinkedin, authordribble, authorwhatsapp, authoremail in versions up to...

WordPress Filter Everything — WordPress & WooCommerce Filters plugin <= 1.9.6 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Omar Elshopky 3l5h0pky in WordPress Plugin Filter Everything — WordPress & WooCommerce Filters versions = 1.9.6...