HDWebmobile Product Filters

HDWebmobile Product Filters

Filter the shop by attribute, price, category, stock and rating — every filter is applied through WordPress’s own query API, no filter value is ever put into a SQL string.

Overview

HDWebmobile Product Filters adds a filter panel to your shop and product-category pages. Shoppers narrow the product grid by price range, category, product attributes (colour, size, and so on), stock status, on-sale, and minimum rating. With JavaScript enabled the grid updates without a full page reload; with it disabled the same filters still work as ordinary links.

Shop-filter plugins take input straight from the URL on a public, unauthenticated page, which makes them a common home for SQL injection. “Product Filter for WooCommerce by WBW” (versions before 3.1.3) shipped CVE-2025-8416 and CVE-2026-3830: a filter parameter from an unauthenticated visitor was concatenated into a raw SQL statement with no escaping or preparation, turning the storefront filter into a database-read primitive. This plugin closes that entire class of bug by construction: no SQL is ever built directly — every filter is turned into standard WP_Query arguments (tax_query, meta_query, post__in) and handed to WooCommerce’s own product query through the woocommerce_product_query hook, so WordPress prepares and escapes all of it. The plugin never calls $wpdb directly. Every value is validated before use — category and attribute filters are matched against real, registered taxonomies and terms; prices are cast with floatval() and clamped; stock status and rating are checked against a fixed allow-list; an unrecognised or malformed value is dropped, not passed along. The filters are also read-only: nothing about them changes site state.

Key Features

• Filter by price range, category, product attributes, stock status, on sale, and minimum rating
• Choose which filters to show, from WooCommerce > HDWebmobile > Product Filters
• Grid updates without a page reload when JavaScript is available; degrades to plain link-based filtering when it isn’t
• Automatic placement above the shop grid, or the [hdpf_filters] shortcode anywhere
• Respects the current sort order, search term and pagination
• Works on the classic shop template and block-based shop/archive templates

Limitations

Please read before installing:

• Filters the main shop / product-category / product-tag / product archive query only
• No filter result counts per option in this version
• Attribute filters cover global product attributes (the pa_* taxonomies), not per-product custom attributes

Quick Setup

1. Upload the plugin files to the /wp-content/plugins/hdwebmobile-product-filters directory, or install through the Plugins screen directly.
2. Activate the plugin through the ‘Plugins’ screen in WordPress. WooCommerce must already be installed and active.
3. Go to WooCommerce > HDWebmobile > Product Filters and choose which filters to show.

Latest Version

Current stable version in readme: 1.0.0 (Initial release: price/category/attribute/stock/rating filters, all routed through WP_Query, no raw SQL anywhere in the plugin.)

See our other WordPress plugins for more WooCommerce and site-utility tools.