CVE-2026-87869Published
Filter Everything — WordPress & WooCommerce Filters <= 1.9.6 - Reflected Cross-Site Scripting via Elementor Posts Widget Pagination URL
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-87869 · Microsoft / collected KEV context
cve-program · CVE-2026-87869
- https://www.wordfence.com/threat-intel/vulnerabilities/id/7f0f453c-ca01-4ccc-b8c0-4468db40386a?source=cve
- https://plugins.trac.wordpress.org/browser/filter-everything/tags/1.9.6/src/wpc-third-party.php#L793
- https://plugins.trac.wordpress.org/browser/filter-everything/tags/1.9.6/src/UrlManager.php#L197
- https://plugins.trac.wordpress.org/browser/filter-everything/tags/1.9.6/src/wpc-helpers.php#L207
- https://plugins.trac.wordpress.org/browser/filter-everything/tags/1.9.2.1/src/wpc-third-party.php#L793
- https://plugins.trac.wordpress.org/browser/filter-everything/tags/1.9.2.1/src/UrlManager.php#L197
- https://plugins.trac.wordpress.org/browser/filter-everything/tags/1.9.2.1/src/wpc-helpers.php#L207
- https://plugins.trac.wordpress.org/changeset?reponame=&old=3707235%40filter-everything&new=3707235%40filter-everything
Related operational evidence
Explicit CVE identifiersNo related operational record is retained in the current change model.