CVE-2026-109995 in Advanced Views Plugin
Summary
by MITRE • 10/27/2026
The Advanced Views – Display Framework for Gutenberg & Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 3.9.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This vulnerability is exploitable even against pending or unapproved comments, as the plugin's get_comment() lookup applies no approval-status filter, meaning a payload executes for any visitor loading an avf-layout block bound to the attacker's comment ID before the comment is ever reviewed.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The Advanced Views – Display Framework for Gutenberg & Elementor WordPress plugin contains a critical security flaw affecting all versions up to and including 3.9.6, characterized by insufficient input sanitization and output escaping mechanisms within its core functionality. This vulnerability specifically targets the comment parameter used in various operations performed by the plugin, allowing malicious actors to inject arbitrary web scripts into the application's data store. The root cause lies in the failure of the software to properly validate user-supplied input before storage or to correctly escape that data when rendering it for end-users, a fundamental oversight that violates basic principles of secure coding practices and creates an environment ripe for client-side attacks.
This flaw enables unauthenticated attackers to execute Stored Cross-Site Scripting, commonly referred to as XSS, against the target WordPress site. Unlike reflected XSS which requires tricking a user into clicking a malicious link, stored XSS persists on the server side by injecting scripts into database records or content fields that are subsequently served to other users. In this specific context, an attacker can submit a comment containing malicious JavaScript code through any interface exposed by the plugin where the vulnerable parameter is processed. Once injected, these scripts become part of the page content and will execute automatically whenever another user views the affected page, effectively compromising the browser session of every visitor who loads the compromised layout block.
A particularly dangerous aspect of this vulnerability is its exploitability against pending or unapproved comments. Typically, WordPress systems filter out unapproved comments from public view to prevent spam and malicious content from reaching end-users until an administrator reviews them. However, due to a logic error in the plugin's get_comment() lookup function, there is no approval-status filter applied when retrieving comment data for display purposes within Advanced Views layouts. This means that even if a comment remains in a pending state awaiting moderation, it can still be rendered and executed by visitors who load an avf-layout block bound to the attacker's specific comment ID. This bypasses standard administrative safeguards and allows immediate exploitation without requiring any level of user interaction or approval from site administrators.
The operational impact of this vulnerability is severe, as successful exploitation leads to a complete compromise of client-side security for affected users. Attackers can steal session cookies, hijack active sessions, perform actions on behalf of legitimate users, deface websites, redirect traffic to malicious sites, or deploy further malware through drive-by downloads. Since the attack vector does not require authentication, any visitor with access to the public-facing website can be targeted simply by viewing a page that utilizes the vulnerable plugin configuration. This significantly lowers the barrier for entry and increases the potential scale of impact across large user bases.
To mitigate this risk, immediate action is required from site administrators using versions 3.9.6 or earlier of the Advanced Views – Display Framework plugin. The primary remediation step is to upgrade the plugin to a patched version where proper input sanitization and output escaping have been implemented for all comment-related parameters. Until an update can be applied, temporary mitigations include disabling any public-facing features that allow unauthenticated users to submit comments or interact with layout blocks bound to user-generated content. Additionally, implementing strict Content Security Policy headers can help mitigate the impact of successful XSS attacks by restricting the sources from which scripts are allowed to execute, although this is not a substitute for fixing the underlying code vulnerability. Regular security audits and adherence to OWASP guidelines for input validation and output encoding should be enforced in future development cycles to prevent similar issues.