CVE-2026-40806

WordPress Blog, Posts and Category Filter for Elementor plugin <= 2.1.0 - Cross Site Scripting (XSS) vulnerability

Plugin Devs Blog, Posts and Category Filter for Elementor

CVSS

7.1High

ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV

Exploit odds (EPSS)0.19%Chance of exploitation activity in the next 30 days, higher than 8% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed inNone listedNo source names a fixed version yet

Published6 Oct 2026Updated 6 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Unauthenticated Cross Site Scripting (XSS) in Blog, Posts and Category Filter for Elementor <= 2.1.0 versions.

Text from CVE List

Blog, Posts and Category Filter for Elementoraffected: n/a through 2.1.0CVE List