CVE-2026-78172

Executive Summary

CVE-2026-78172 is a reflected cross-site scripting (XSS) vulnerability in the Themify – WooCommerce Product Filter plugin for WordPress, affecting all versions up to and including 1.5.5. The flaw stems from insufficient input sanitization and output escaping of a query parameter name, allowing unauthenticated attackers to inject arbitrary web scripts into pages that execute when a victim clicks a crafted link. Successful exploitation enables session hijacking, credential theft, and arbitrary actions in the context of the victim's browser, though it requires user interaction and the attacker cannot directly compromise the server.

Technical Analysis

The vulnerability class is CWE-79: Improper Neutralization of Input During Web Page Generation ("Cross-Site Scripting"), specifically the reflected subtype. According to the NVD description, the flaw originates in the handling of a query parameter name — that is, the identifier of an HTTP GET parameter rather than its value — which is processed by the plugin without sufficient input sanitization and subsequently emitted into a page response without adequate output escaping.

The mechanism follows the classic reflected XSS pattern:

1. A user-controlled value arrives at the application via an HTTP query parameter.
2. The plugin fails to neutralize special characters (such as <, >, ", ', and &) on input, and equally fails to context-appropriately escape the value on output.
3. The unsanitized data is embedded into HTML returned to the browser, where it is parsed as active markup or script rather than inert text.
4. The victim's browser executes attacker-supplied script in the security context (origin) of the vulnerable WordPress site.

The CVSS v3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N confirms the key characteristics: the attack is network-reachable (AV:N) with low complexity (AC:L) and requires no authentication (PR:N), but demands victim interaction (UI:R). The Scope Changed (S:C) metric is significant — exploitation affects resources beyond the vulnerable component's security authority, consistent with XSS where script executes in the victim's browsing context and can affect the wider site origin. Confidentiality and Integrity impacts are Low (C:L/I:L), reflecting the ability to read session data and perform limited state-changing actions, while Availability is None (A:N).

Notably, the description references a "query parameter name," which distinguishes this from value-reflection issues. The parameter name itself is reflected without escaping, so the attacker must control the parameter name rather than only a parameter value. Because the CVE record provides no verbatim function names, file paths, URL endpoints, or parameter names, the precise code location within the plugin cannot be reliably enumerated here. Any attempt to name specific functions or files would be speculative; consumers of this report should seek the vendor's repository or a researcher disclosure for exact call-site detail.

No public proof-of-concept, Nuclei template, or exploit code was identified at the time of writing. Patch confidence is 0/4: no vendor fix, advisory, or version constraint evidence is present in tracked sources. The plugin should be considered unpatched.

Exploitation Scenarios

Note: No public PoC is available. The following attack chain is inferred strictly from the vulnerability class (reflected XSS via a query parameter name) and the information present in the CVE record. No specific endpoints, parameter names, or code patterns are asserted.

1. Reconnaissance / Target Identification. The attacker enumerates WordPress sites running the Themify – WooCommerce Product Filter plugin. Because the plugin is a WooCommerce extension, targets are e-commerce WordPress deployments. Fingerprinting can use asset enumeration of the plugin directory or page-source inspection for plugin-specific HTML/CSS/JS markers. Shodan and similar engines can identify candidate sites via HTTP body signatures.

2. Triggering the Flaw Class. The attacker constructs a URL that embeds malicious markup or script in a position where the plugin reflects an unescaped query parameter name into the returned HTML. Since the flaw is in the parameter name rather than its value, the malicious string is placed in the name portion of the query string. When the crafted URL is requested, the server reflects the injected content into the response without sanitization or escaping, producing a page whose HTML contains attacker-controlled script.

3. Payload / Execution Method. At the vulnerability-class level, the payload is JavaScript (or markup containing an event handler / script element) that the victim's browser parses and executes in the origin of the vulnerable site. Delivery requires social engineering: the attacker must induce the victim to click the crafted link (UI:R). Because the script runs under the target site's origin, it inherits the victim's session context, including any WordPress authentication cookies and WooCommerce session state.

4. Post-Exploitation Impact. Within scope-changed XSS, the attacker can:

   • Read and exfiltrate data accessible to the page (e.g., DOM content, tokens exposed to script).
   • Perform actions as the victim, including modifying account or cart state via same-origin requests (integrity impact).
   • Redirect the victim to phishing infrastructure or inject fraudulent content into the storefront.
   • In authenticated contexts, attempt session-dependent actions such as privilege escalation against the WordPress admin panel if an administrator is lured.

The CVSS subscores (C:L, I:L, S:C, UI:R, PR:N) are consistent with this model: meaningful but bounded confidentiality and integrity loss, contingent on victim interaction, with broadened scope.

Impact Assessment

• Affected systems: WordPress installations using the Themify – WooCommerce Product Filter plugin, versions up to and including 1.5.5, particularly e-commerce sites.
• Authentication requirement: None for the attacker (PR:N); victim interaction is required (UI:R).
• Business impact: Reflected XSS enables session hijacking, credential/session token theft, and on-origin actions impersonating users — including potentially site administrators if lured. For e-commerce deployments this can translate to customer account compromise, fraudulent transactions, and retail brand damage.
• Blast radius: The Scope Changed (S:C) metric means impact extends beyond a single vulnerable component into the broader site origin and the victim's browser session.
• Severity: Base score 6.1 (Medium). No CISA KEV listing, no public exploit, and EPSS is not yet scored by FIRST.org (no value fabricated here), so near-term mass-exploitation risk is assessed as lower, though the unpatched state elevates residual risk.

Detection Guidance

Detection must compensate for the absence of an authoritative PoC; rules below target the general reflected-XSS behavior class and the plugin's request footprint. They should be tuned to the deployment.

Sigma Rule

title: Reflected XSS Attempt via Query Parameter Name - Themify WooCommerce Product Filter
id: 3f9c1a2e-7b4d-4e21-9c88-themify78172
status: experimental
description: Detects HTTP requests attempting reflected XSS by injecting script/markup into a query parameter name targeting WordPress WooCommerce sites.
author: valtersit.com
logsource:
  category: webserver
detection:
  selection_method:
    cs-method: 'GET'
  selection_plugin:
    cs-uri-query|contains:
      - 'product-filter'
      - 'themify'
  selection_payload:
    cs-uri-query|contains:
      - '<script'
      - '%3Cscript'
      - 'onerror='
      - 'onload='
      - 'javascript:'
      - '<img'
      - '%3Cimg'
      - '<svg'
      - '%3Csvg'
  condition: selection_method and selection_plugin and selection_payload
falsepositives:
  - Security scanners and WAF test traffic
  - Legitimate encoded content in URLs
level: high
tags:
  - attack.t1189
  - cve.2026.78172

YARA Rule

rule CVE_2026_78172_Themify_WC_Product_Filter_XSS
{
    meta:
        author = "valtersit.com"
        description = "Detects reflected XSS payload patterns associated with Themify WooCommerce Product Filter <= 1.5.5"
        cve = "CVE-2026-78172"
        severity = "medium"
        date = "2026"
    strings:
        $plug1 = "themify-woocommerce-product-filter" ascii wide nocase
        $plug2 = "themify-wc-product-filter" ascii wide nocase
        $xss1  = "<script>" ascii wide nocase
        $xss2  = "onerror=" ascii wide nocase
        $xss3  = "onload=" ascii wide nocase
        $xss4  = "<svg/onload" ascii wide nocase
        $xss5  = "javascript:" ascii wide nocase
    condition:
        any of ($plug*) and any of ($xss*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-78172 Themify WooCommerce Product Filter Reflected XSS Attempt"; flow:to_server,established; http.method; content:"GET"; http.uri; content:"product-filter"; nocase; http.uri; pcre:"/(%3C|<)script|onerror=|onload=|javascript:/i"; reference:cve,2026-78172; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-78172; classtype:web-application-attack; sid:202678172; rev:1;)

Elastic Detection

sequence by source.ip
  [ any where http.request.method == "GET" and
      wildcard(http.request.url.query, "*product-filter*") and
      (wildcard(http.request.url.query, "*%3Cscript*") or
       wildcard(http.request.url.query, "*<script*") or
       wildcard(http.request.url.query, "*onerror=*") or
       wildcard(http.request.url.query, "*onload=*") or
       wildcard(http.request.url.query, "*javascript:*")) ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=iis
| where method="GET"
| eval uri_q=lower(uri_query)
| where (like(uri_q, "%product-filter%") OR like(uri_q, "%themify%"))
    AND (like(uri_q, "%3cscript%") OR like(uri_q, "%<script%")
      OR like(uri_q, "%onerror=%") OR like(uri_q, "%onload=%")
      OR like(uri_q, "%javascript:%") OR like(uri_q, "%3csvg%"))
| stats count values(uri_path) as paths values(clientip) as clients by host
| sort - count

Wazuh OSSEC Rule

<group name="web,attack,cve_2026_78172,">
  <rule id="100172" level="10">
    <if_sid>31100</if_sid>
    <url>product-filter|themify</url>
    <match>script|onerror=|onload=|javascript:|%3Cscript|%3Csvg</match>
    <description>CVE-2026-78172: Possible reflected XSS attempt against Themify WooCommerce Product Filter</description>
    <mitre>
      <id>T1189</id>
    </mitre>
    <group>cve_2026_78172,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor fix, advisory, or version constraint is available. Treat all versions up to and including 1.5.5 as vulnerable.

1. Immediate mitigations

   • Deploy a Web Application Firewall (WAF) with reflected-XSS rules and virtual patching for the plugin's request pattern; enable URL query-string inspection including decoded and double-encoded payloads.
   • Where feasible, disable or remove the plugin until a fix is available (see hardening).
   • Restrict untrusted access at the edge where the plugin is not strictly required.

2. Patch / upgrade steps

   • Monitor the vendor (Themify) and the WordPress plugin directory for a security release; no fixed version exists as of this report.
   • Upon release, update via the WordPress admin or standard plugin deployment pipeline, and verify the installed version exceeds 1.5.5.

3. Long-term hardening

   • Enforce a plugin inventory and vulnerability-management process; remove unused plugins to reduce attack surface.
   • Apply Content Security Policy (CSP) headers to constrain inline script execution and mitigate XSS impact.
   • Set session cookies with HttpOnly and Secure attributes, and use SameSite to limit cross-origin request abuse.
   • Ensure developers apply context-aware output escaping and input validation as a standard control for all query parameters, including parameter names.

References

1. NVD — CVE-2026-78172: https://nvd.nist.gov/vuln/detail/CVE-2026-78172
2. MITRE CWE-79 — Improper Neutralization of Input During Web Page Generation: https://cwe.mitre.org/data/definitions/79.html
3. MITRE ATT&CK T1189 — Drive-by Compromise: https://attack.mitre.org/techniques/T1189/
4. Themify — WooCommerce Product Filter plugin (vendor) — monitor for a security advisory; none published at time of writing.
5. FIRST.org EPSS — no score available for CVE-2026-78172 at time of writing.

Threat actor / in-the-wild note: No CISA KEV listing, no public PoC, no exploit code, and no attribution to known threat actor campaigns was identified for CVE-2026-78172. All detection content above is derived from the vulnerability class and standard reflected-XSS tradecraft, not from observed exploitation.