Description

Unauthenticated Cross Site Scripting (XSS) in Advanced AJAX Product Filters <= 3.2.0.3 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-06T15:17:19.937Z",
  "pubdate": "2026-08-06T15:17:19.937Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the Advanced AJAX Product Filters plugin affecting versions <= 3.2.0.3. This security flaw allows remote, unauthenticated attackers to inject malicious client-side scripts, typically JavaScript, into web pages rendered to legitimate application users. The primary risk implication involves the potential execution of arbitrary script code within the context of a victim's browser session, which can lead to session hijacking, credential theft, sensitive data exposure, and unauthorized actions performed on behalf of the authenticated user. The vulnerability stems from improper input sanitization and inadequate output encoding within the product filtering mechanisms exposed by the affected plugin. Exploitation requires no prior authentication or administrative privileges, meaning any remote network attacker can interact with the vulnerable endpoint to deliver the malicious payload. Remediation requires updating the Advanced AJAX Product Filters plugin beyond version 3.2.0.3 once a security patch is made available by the vendor, or implementing strict web application firewall (WAF) rules to filter malicious payload patterns targeting the vulnerable parameters.",
  "technicalDetails": "The vulnerability is an unauthenticated Cross-Site Scripting (XSS) flaw residing in the Advanced AJAX Product Filters plugin for versions <= 3.2.0.3. The root cause of the vulnerability is the failure of the application to properly sanitize, validate, or encode user-supplied input parameters before reflecting them back into the Document Object Model (DOM) or HTTP response. Specifically, parameters handled by the AJAX filtering routines process incoming HTTP requests and incorporate unsanitized data directly into the web page output.\nNetwork exposure is fully public, as the vulnerable filtering endpoints are accessible to unauthenticated visitors over standard HTTP/HTTPS protocols. Attackers do not require any privilege level or authentication tokens to trigger the vulnerable code path. The attack flow begins when an adversary crafts a malicious URL or sends a specially crafted HTTP request containing an executable script payload, such as a <script> tag or event handler attributes (e.g., onload, onerror), directed at the vulnerable Advanced AJAX Product Filters endpoint.\nUpon receiving the request, the vulnerable component processes the input parameter and includes the malicious payload within the AJAX response or the dynamically updated DOM elements without applying contextual output encoding. When a victim's browser parses the returned data, the injected payload executes within the security context of the victim's session. This payload behavior allows the script to access document properties, manipulate page content, read session cookies, or perform unauthorized API requests under the identity of the affected user.\nThe post-exploitation impact depends on the privileges of the user interacting with the injected content. If an administrative user views the compromised page, the execution of arbitrary JavaScript could lead to full site takeover through the creation of new administrator accounts, the modification of theme or plugin files, or the execution of server-side code where available. For standard users, the impact remains bounded to session compromise, data theft, and defacement of the affected application view."
}