CVE-2026-109983 in YMC Filter Plugin
Summary
by MITRE • 10/17/2026
The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'post_title' parameter in all versions up to, and including, 3.12.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The autocomplete REST endpoint is registered with a permission callback that unconditionally returns true, meaning any site visitor — including unauthenticated users — can trigger the payload simply by typing in the YMC filter search box, while only Author-level access is required to store it.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/17/2026
The vulnerability identified within the YMC Filter plugin for WordPress represents a significant security risk stemming from insufficient input sanitization and output escaping mechanisms. Specifically, this flaw manifests as a Stored DOM-Based Cross-Site Scripting (XSS) issue affecting all versions up to and including 3.12.19. The core technical deficiency lies in the handling of the post_title parameter, which is not adequately processed before being stored or rendered within the application context. This lack of rigorous validation allows malicious actors to inject arbitrary web scripts into the database, which are subsequently executed when other users interact with the affected pages.
The operational impact of this vulnerability is severe due to its persistent nature and broad accessibility. While storing the payload requires authenticated access at least at the author level or above, the execution vector does not require authentication for the victim user. The autocomplete REST endpoint associated with the plugin contains a critical permission callback that unconditionally returns true. This configuration error means that any site visitor, including completely unauthenticated users, can trigger the malicious script simply by typing into the YMC filter search box. Consequently, an attacker who has gained author-level access can embed a payload that will execute in the browsers of all subsequent visitors to the page, facilitating widespread compromise without requiring further interaction from those victims.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves stored XSS where malicious content is saved on the target server and later served to other users. Furthermore, in terms of tactical mapping within the MITRE ATT&CK framework for enterprise security, this behavior corresponds to T1059 Command and Control via Web Protocols or potentially T1189 Drive-by Client Side Scripting if the payload leads to further exploitation chains such as credential harvesting or session hijacking. The combination of stored persistence with an unauthenticated execution vector significantly elevates the severity rating compared to typical reflected XSS vulnerabilities.
To mitigate this risk, immediate action is required by upgrading the YMC Filter plugin to a version that addresses these sanitization and permission issues. Administrators should ensure that all input fields, particularly those handling user-generated content like post titles or search queries, are strictly sanitized using appropriate WordPress functions such as wp_kses_post or similar context-aware escaping mechanisms before storage. Additionally, output rendering must employ proper encoding techniques to prevent browser interpretation of injected scripts. The REST endpoint permission callback must be corrected to enforce strict authentication and authorization checks, ensuring that only users with verified privileges can interact with sensitive endpoints. Regular security audits and penetration testing should also be conducted to identify similar patterns of insufficient input validation across the WordPress ecosystem.