CVE-2026-78172: Themify WooCommerce Filter XSS Vulnerability

CVE-2026-78172 Overview

CVE-2026-78172 is a Reflected Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Themify – WooCommerce Product Filter plugin for WordPress. All versions up to and including 1.5.5 are affected. The flaw stems from insufficient input sanitization and output escaping on a query parameter name processed by the plugin. Unauthenticated attackers can craft URLs that inject arbitrary web scripts. Scripts execute in a victim's browser when the victim clicks a malicious link.

Critical Impact
Successful exploitation can hijack authenticated sessions, redirect users, or perform actions in the context of the victim on WordPress sites running the vulnerable plugin.

Affected Products

Themify – WooCommerce Product Filter plugin for WordPress
All versions up to and including 1.5.5
WordPress sites with WooCommerce that install the affected plugin

Discovery Timeline

2026-09-11 - CVE-2026-78172 published to NVD
2026-09-11 - Last updated in NVD database

Technical Details for CVE-2026-78172

Vulnerability Analysis

The plugin reflects a user-controlled query parameter name into rendered HTML output without adequate sanitization or contextual escaping. Because the injection point is the parameter name rather than a value, standard value-oriented filters do not apply. An attacker constructs a URL containing a crafted parameter name that includes JavaScript. When a victim follows the link, the server-rendered page echoes the attacker-supplied content into the response, and the browser executes it.

The vulnerability requires user interaction but no authentication. The scope changes because scripts execute in the context of the affected WordPress origin, potentially reading session cookies, initiating admin actions if the victim is an administrator, or performing account takeover through forced state changes.

Root Cause

The root cause is missing input sanitization and output escaping in the plugin's request-handling code paths. Relevant source locations include includes/class-wpf-utils.php around line 464 and public/class-wpf-public.php around lines 87 and 937, referenced in the Themify WC Product Filter Utils and Themify WC Product Filter Public Class source. The plugin iterates request parameters and reflects the parameter name back into markup without applying esc_attr() or esc_html() before output.

Attack Vector

Exploitation follows a standard reflected XSS chain. The attacker crafts a URL to a page on the target site that invokes the plugin's filter logic, using a parameter name that contains an HTML or JavaScript payload. The attacker delivers the link through phishing, comments, or third-party sites. When a victim clicks the link, the payload renders and executes. See the Wordfence Vulnerability Analysis for additional technical context.

No verified proof-of-concept code is published. Refer to the plugin source and vendor advisory for technical detail.

Detection Methods for CVE-2026-78172

Indicators of Compromise

HTTP request URLs to WordPress endpoints containing unusual query parameter names with <script>, onerror=, javascript:, or encoded angle brackets (%3C, %3E).
Referer headers from external sources pointing to filter pages with malformed query strings.
Unexpected outbound requests from user browsers to attacker-controlled domains following visits to product filter pages.

Detection Strategies

Inspect web server access logs for query strings where the parameter name itself contains HTML metacharacters or scripting keywords.
Deploy Web Application Firewall (WAF) rules that flag reflected XSS patterns in both parameter names and values.
Correlate suspicious inbound requests with subsequent administrator session activity to identify possible session hijacking.

Monitoring Recommendations

Monitor WordPress admin account logins and privilege changes for anomalies following exposure windows.
Alert on requests to WooCommerce filter endpoints containing encoded script tags or event handler attributes.
Track plugin version inventory across WordPress sites to identify hosts still running 1.5.5 or earlier.

How to Mitigate CVE-2026-78172

Immediate Actions Required

Update the Themify – WooCommerce Product Filter plugin to the version released after 1.5.5 that includes the fix.
Audit WordPress sites to inventory installed plugin versions and prioritize public storefronts for patching.
Review administrator and customer account activity for signs of session abuse during the exposure window.

Patch Information

The vendor addressed the vulnerability in a plugin update following version 1.5.5. Review the code changes documented in the Themify WC Product Filter Changeset and apply the latest release from the WordPress plugin repository.

Workarounds

Deactivate and remove the plugin until the patched version is installed if immediate updating is not possible.
Deploy WAF rules that block requests where query parameter names contain HTML or JavaScript metacharacters.
Enforce a strict Content Security Policy (CSP) that disallows inline scripts to reduce the impact of reflected XSS.

bash

# Example WAF rule concept (ModSecurity) to block script content in query parameter names
SecRule ARGS_NAMES "@rx (?i)(<script|onerror=|javascript:|%3Cscript)" \
  "id:1026781720,phase:2,deny,status:403,msg:'Potential XSS in query parameter name (CVE-2026-78172)'"