CVE-2026-109983
MediumCVSS 6.4Summary
The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'post_title' parameter in all versions up to and including 3.12.19 due to insufficient input sanitization and output escaping. Authenticated attackers with author-level access can inject arbitrary web scripts that execute when a user visits the affected page.
Risk Assessment
An attacker can execute arbitrary JavaScript in the user's browser, potentially leading to session or data theft.
Recommendation
Update the YMC Filter plugin to a version later than 3.12.19 that includes sanitization and escaping fixes.
Other vulnerabilities in YMC Filter
See all- CVE-2026-16559Medium
The YMC Filter WordPress plugin before version 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users. Users with the Author role and above can upload a file containing JavaScript that executes in the site's origin when the file is viewed.
- CVE-2026-16558Medium
The YMC Filter WordPress plugin before version 3.12.8 does not sanitize and escape a layout builder setting before outputting it on a public endpoint, and does not verify object ownership when the setting is saved. Users with the Contributor role and above can store JavaScript that executes in the browser of any visitor viewing an affected filter.
Original NVD description (English source)
The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'post_title' parameter in all versions up to, and including, 3.12.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The autocomplete REST endpoint is registered with a permission callback that unconditionally returns true, meaning any site visitor — including unauthenticated users — can trigger the payload simply by typing in the YMC filter search box, while only Author-level access is required to store it.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS