Vulnerability alerts / October 28, 2026

Vulnerability in Filter Everything — WordPress & WooCommerce Filters — CVE-2026-116390

HighSeverity
CVSS 7.2

—Estimated exploit probability
EPSS

50,000+ sitesInstalls

Not publishedFixed in

What to do now

No fix has been published yet. Consider disabling Filter Everything — WordPress & WooCommerce Filters for now, or moving to an alternative.

Affected versions

Everything up to and including 1.9.7

Affected: Filter Everything — WordPress & WooCommerce Filters (plugin, filter-everything)

Check: The plugin on wordpress.org / Our record for Filter Everything — WordPress & WooCommerce Filters

What the vulnerability is

Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything — WordPress & WooCommerce Filters filter-everything allows Object Injection.This issue affects Filter Everything — WordPress & WooCommerce Filters: from n/a through 1.9.7.

This description is reproduced verbatim from the public vulnerability record.

Sources

https://patchstack.com/database/wordpress/plugin/filter-everything/vulnerability/wordpress-filter-everything-wordpress-woocommerce-filters-plugin-1-9-7-php-object-injection-vulnerability?_s_id=cve

This page is compiled automatically from public databases. Accuracy is not guaranteed; confirm against the vendor advisory before acting.

See other alerts