CVE-2025-8073

The Dynamic AJAX Product Filters for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.3.7. The vulnerability exists due to insufficient input sanitization and output escaping of the 'name' parameter, allowing stored scripts to be injected into pages.

Exploitation requires authenticated access with at least Contributor-level permissions. An attacker can inject arbitrary web scripts through the 'name' parameter, which are then stored and executed whenever any user accesses the affected page.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser, potentially leading to session hijacking, defacement, or redirection to malicious sites [1].

Mitigation involves updating to a patched version of the plugin beyond 1.3.7 if available. Until then, administrators should restrict Contributor-level access to trusted users only.