The vulnerability is an improper neutralization of input during web page generation, resulting in a reflected XSS in the HUSKY Woocommerce‑Products‑Filter plugin. An attacker can inject script payloads that execute in the browsers of users who view reflected data, potentially allowing the attacker to capture sensitive information or perform actions on behalf of the user. This weakness is classified as CWE‑79.

PluginUs.Net’s HUSKY Woocommerce‑Products‑Filter plugin, all releases up to version 1.4.3.2 are affected; newer releases are believed to be fixed.

The CVSS score of 7.1 indicates a high severity. The EPSS score is not available, so the exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves a crafted HTTP request to the WordPress site that includes attacker-supplied input; because the input is reflected without proper escaping, a browser executing the page will run the injected script.