The Advanced AJAX Product Filters plugin for WordPress has a reflected cross‑site scripting vulnerability that is triggered by the nonce parameter. Because the plugin does not properly sanitize or escape the value supplied in this parameter, an attacker can embed arbitrary JavaScript into a page by crafting a URL that includes the vulnerable nonce. When an unsuspecting user follows such a link, the browser executes the injected script in the context of the site.

All WordPress sites that install the Berocket Advanced AJAX Product Filters plugin in any version up to and including 1.6.8.1 are impacted. The flaw exists throughout the plugin’s core code across these releases.

The CVSS v3 score of 6.1 indicates medium severity, while the EPSS score of less than 1% suggests that exploitation is currently unlikely but still possible. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to construct a malicious URL that contains the vulnerable nonce value and to persuade a user to click it, thereby triggering script execution. Based on the description, it is inferred that the injected script could potentially lead to defacement, credential theft, or delivery of additional malware, though such outcomes are not explicitly confirmed in the advisory.