Advanced Views: Stored Cross-Site Scripting in Display Framework (CVE-2026-109995)

The Advanced Views - Display Framework for Gutenberg & Elementor plugin for WordPress (all versions up to and including 3.9.6) contains a Stored Cross-Site Scripting (XSS) vulnerability. Insufficient input sanitization and output escaping on the 'comment' parameter allow unauthenticated attackers to inject malicious web scripts.

The vulnerability is accessible because the plugin's get_comment() function does not filter for comment approval status. Consequently, an attacker can submit a malicious script in a pending or unapproved comment, which will then execute when any visitor loads a page containing an avf-layout block associated with the attacker's comment ID, bypassing the need for administrative approval.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary web scripts in the browsers of users visiting pages with affected layout blocks. This can lead to session hijacking, unauthorized actions performed on behalf of authenticated users, or redirection to malicious content.

Recommendation

• Update the "Advanced Views - Display Framework for Gutenberg & Elementor" plugin to a version released after 3.9.6 that addresses the sanitization and validation failures in the comment parameter.
• Monitor WordPress web server logs for suspicious POST requests targeting the comment submission endpoint that contain script tags or character sequences common in XSS payloads (e.g., <script>, onerror, onload).
• Review existing and pending comments for malicious scripts if the plugin remains unpatched in the environment.