CVE-2025-6255

The Dynamic AJAX Product Filters for WooCommerce plugin suffers from a stored cross-site scripting (XSS) vulnerability due to insufficient input sanitization and output escaping on the 'className' parameter. This allows authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts via the plugin's filter settings [1].

Attackers can exploit this by crafting a malicious 'className' value that, when saved, will execute in the context of any user viewing pages containing the injected filter. No special network access or additional authentication is needed beyond the contributor-level account.

Successful exploitation enables an attacker to execute arbitrary JavaScript in the browsers of other users, including administrators. This can lead to session hijacking, defacement, or further privilege escalation within the WordPress site.

The vulnerability is present in all versions up to and including 1.3.7. Users are advised to update to version 1.3.8 or later, which contains the necessary sanitization fixes [1].