Live › vulnerability › CVE-2026-116390
Go to dashboardThe Filter Everything plugin for WordPress and WooCommerce unsafely deserializes untrusted data, which is a PHP object injection flaw. Depending on the available gadget chains on the site, an attacker may be able to run code or change application data.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 14:33 UTC. All times on this page are UTC.
Sites running the Filter Everything plugin version 1.9.7 or earlier, with WordPress or WooCommerce product filtering enabled. The sources do not say which request paths or settings trigger the deserialization, so treat any site with the plugin installed as in scope. Sites that do not have the plugin installed are not affected.
No product ranges from the sources yet.
wp-content/plugins/filter-everything/ header of the main plugin file.1.9.7 or earlier, which the sources list as affected.1.9.7; the sources do not name the exact fixed release, so check the plugin's changelog.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything — WordPress & WooCommerce Filters filter-everything allows Object Injection.This issue affects Filter Everything — WordPress & WooCommerce Filters: from n/a through 1.9.7.
This page as .md · .json · in your agent: get_signal("CVE-2026-116390")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.