CVE-2026-16559
MediumCVSS 6.8Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The YMC Filter WordPress plugin before version 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users. Users with the Author role and above can upload a file containing JavaScript that executes in the site's origin when the file is viewed.
Risk Assessment
An attacker with Author role can execute arbitrary script in the browser of an administrator or other users, potentially leading to session hijacking, data theft, or further compromise of the site.
Recommendation
Update the YMC Filter plugin to version 3.12.9 or later, which includes the SVG sanitization fix. Additionally, restrict file upload permissions to trusted users only.
Original NVD description (English source)
The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users, allowing users with the Author role and above to upload a file containing JavaScript that executes in the site's origin when the file is viewed.