CVE-2026-8865: Avalon23 WooCommerce Filter XSS Vulnerability

CVE-2026-8865 Overview

CVE-2026-8865 is a Stored Cross-Site Scripting (XSS) vulnerability in the Avalon23 Products Filter for WooCommerce plugin for WordPress. The flaw affects all plugin versions up to and including 1.1.6. It resides in the avalon23_qr shortcode handler, where user-supplied attributes are concatenated into HTML without sanitization or output escaping. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript that executes when other users view affected pages. The vulnerability is tracked under CWE-79 and is described in the Wordfence Vulnerability Report.

Critical Impact
Authenticated contributors can store JavaScript payloads that execute in the browsers of site visitors and administrators, enabling session theft, content manipulation, and privilege escalation through targeted admin-side execution.

Affected Products

Avalon23 Products Filter for WooCommerce plugin for WordPress
All versions through 1.1.6
WordPress sites using the avalon23_qr shortcode

Discovery Timeline

2026-06-24 - CVE-2026-8865 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-8865

Vulnerability Analysis

The vulnerability exists in the AVALON23_HELPER::draw_html_item() helper function within the plugin's classes/helper.php file. The helper builds HTML output by concatenating shortcode attribute values directly into single-quoted HTML attributes. No call to esc_attr() or any other encoding routine is applied before the values reach the rendered markup.

When a Contributor or higher-privileged user inserts the avalon23_qr shortcode into post content, attributes such as title and fixed_link are written into the page unmodified. An attacker can break out of the surrounding single-quoted attribute and inject an event handler such as onerror or onmouseover containing arbitrary JavaScript. The payload is stored in the database and replayed to every viewer of the page.

This vulnerability has a Scope:Changed designation because injected scripts execute in the security context of the WordPress site itself, affecting users beyond the attacker's privilege boundary, including administrators.

Root Cause

The root cause is missing output escaping in the shortcode rendering path. WordPress provides esc_attr() and related helpers specifically for safely emitting user-controlled data into HTML attributes. The plugin code referenced in the QR Generator source at line 96 and line 113 passes raw attribute values into the helper at helper.php line 17, which interpolates them straight into the HTML string.

Attack Vector

Exploitation requires an authenticated WordPress account with Contributor role or higher. The attacker creates or edits a post containing the avalon23_qr shortcode with a malicious title or fixed_link attribute. The payload uses a single quote to terminate the attribute value and adds a JavaScript event handler. When any user, including an administrator reviewing the post, loads the page, the script executes in their browser session under the site's origin.

Detection Methods for CVE-2026-8865

Indicators of Compromise

Post or page content containing avalon23_qr shortcodes with suspicious characters such as single quotes, angle brackets, or on* event handler names in attribute values
Outbound requests from visitor browsers to unfamiliar domains after viewing pages that render the plugin's QR shortcode
New or modified posts authored by Contributor-level accounts that include the avalon23_qr shortcode
Unexpected administrator session activity following the rendering of contributor-submitted content

Detection Strategies

Scan the wp_posts table for post_content matching the pattern [avalon23_qr combined with ', <script, or on[a-z]+= substrings
Review web server access logs for requests to pages containing the shortcode that correlate with anomalous JavaScript-driven traffic
Enable Content Security Policy (CSP) violation reporting to surface inline scripts triggered by injected handlers
Monitor WordPress audit logs for posts edited by Contributor accounts that introduce shortcode attributes containing non-printable or quote characters

Monitoring Recommendations

Alert on creation or editing of posts by low-privilege roles that include the avalon23_qr shortcode
Track administrator account actions occurring within minutes of viewing contributor-authored posts to identify hijacked sessions
Inspect HTTP responses from pages rendering the shortcode for unescaped quote characters inside attribute values

How to Mitigate CVE-2026-8865

Immediate Actions Required

Deactivate the Avalon23 Products Filter for WooCommerce plugin until a patched version is installed
Audit all posts and pages containing the avalon23_qr shortcode and remove any with suspicious attribute content
Restrict the Contributor role on production sites or require editorial review before contributor content is published or previewed by privileged users
Rotate administrator credentials and invalidate active sessions if injected payloads are found

Patch Information

At the time of publication, the NVD entry does not list a fixed version. Site operators should monitor the Wordfence Vulnerability Report and the plugin source repository for an updated release that applies esc_attr() to shortcode attributes. Apply the vendor patch as soon as it is published.

Workarounds

Remove the plugin from production environments until a patched version is available
Limit shortcode use by demoting Contributor accounts or filtering shortcodes from contributor submissions through kses policies
Deploy a web application firewall rule that blocks requests containing [avalon23_qr attributes with quote-breaking patterns
Apply a strict Content Security Policy that disallows inline event handlers and unsafe inline scripts

bash

# Configuration example: deactivate the vulnerable plugin via WP-CLI
wp plugin deactivate avalon23-products-filter-for-woocommerce

# Search the database for potentially injected shortcode usage
wp db query "SELECT ID, post_title, post_author FROM wp_posts \
  WHERE post_content LIKE '%[avalon23_qr%' \
  AND (post_content LIKE '%on%=%' OR post_content LIKE '%<script%');"