The Product Filter Widget for Elementor plugin contains a reflected cross‑site scripting flaw in the 'args[filterFormArray]' parameter. Because the value is never sanitized or properly escaped before being sent to the browser, an unauthenticated attacker can insert arbitrary JavaScript that executes in the victim’s context when the payload is displayed. This allows session hijacking, defacement, or phishing attacks against users who follow a crafted link, making the vulnerability a classic XSS vector.

WordPress sites running the Product Filter Widget for Elementor plugin by brthumar1959, versions up to and including 1.0.6 inclusive, are affected.

The CVSS score of 6.1 indicates moderate severity. EPSS is not available, but the flaw can be exploited remotely via a CSRF‑style HTTP request to admin-ajax.php without authentication. The lack of nonce verification means an attacker only needs to trick a user into visiting an attacker‑controlled page that auto‑submits the malicious payload. Because the vulnerability does not require any administrative privileges, it can be used by any external actor against any vulnerable site. The vulnerability is not listed in the CISA KEV catalog.