CVE-2026-66439

This CVE exposes a reflected XSS vulnerability in an AJAX-driven WooCommerce product filter plugin. The attack vector is straightforward: unauthenticated attackers can inject malicious scripts through filter parameters (category selections, price ranges, attribute values) that the plugin reflects back into the HTML without proper escaping. With over 100,000 active installs, any visitor to a WooCommerce store—without even needing an account—can trigger the vulnerable endpoint and deliver payloads to every subsequent visitor who browses product listings during the exploitation window. What makes this CVE analytically interesting is the EPSS-CVSS disconnect. The low EPSS score suggests automated scanners aren't actively hunting this vector yet—but that window is closing. Historical patterns in this plugin category show a consistent lag: low EPSS at publication, then sharp exploitation uptick within 30-60 days once the CVE enters Wordfence, Sucuri, or scanner signature databases. The gap reflects current inactivity, not structural immunity. The deeper risk isn't individual session theft—it's trust-graph propagation. AJAX filter plugins load on every product listing page, often the homepage. A payload delivered through this vector can harvest sessions from every visitor during the exploitation window, including returning customers with persistent WooCommerce session cookies. For WooCommerce sites handling cardholder data, this creates a direct path into PCI DSS scope that defenders may not have modeled. Your priority: patch immediately, but also treat this as a forcing function to audit any other AJAX filter plugins on the same installation. The pattern here—reflecting query state into the DOM for UX feedback without escaping—is a recurring failure mode in this plugin category. If this plugin's maintainer has a history of sporadic updates or the current version shows abandonment signals (odd versioning like 3.2.0.3), treat the vulnerability as one that will outlive active maintenance. The vulnerable code will persist on abandoned installations for years, even after the patch exists. This isn't compliance paperwork—it's structural exposure that's accruing right now.

Reviewed through automated stages and approved by a human before publication.