🔐 CVE Alert

CVE-2026-116390

HIGH 7.2

WordPress Filter Everything — WordPress & WooCommerce Filters plugin <= 1.9.7 - PHP Object Injection vulnerability

CVSS Score
7.2
EPSS Score
0.0%
EPSS Percentile
0th

Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything&nbsp;— WordPress &amp; WooCommerce Filters filter-everything allows Object Injection.This issue affects Filter Everything&nbsp;— WordPress &amp; WooCommerce Filters: from n/a through 1.9.7.

CWE CWE-502
Vendor stepasyuk
Product filter everything&nbsp;— wordpress &amp; woocommerce filters
Published Oct 28, 2026
Stay Ahead of the Next One

Get instant alerts for stepasyuk filter everything&nbsp;— wordpress &amp; woocommerce filters

Be the first to know when new high vulnerabilities affecting stepasyuk filter everything&nbsp;— wordpress &amp; woocommerce filters are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Affected Versions

stepasyuk / Filter Everything&nbsp;— WordPress &amp; WooCommerce Filters
0 ≤ 1.9.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗
patchstack.com: https://patchstack.com/database/wordpress/plugin/filter-everything/vulnerability/wordpress-filter-everything-wordpress-woocommerce-filters-plugin-1-9-7-php-object-injection-vulnerability?_s_id=cve

Credits

Ananda Dhakal (Patchstack)