CVE-2026-16558 in YMC Filter Plugin
Summary
by MITRE • 08/08/2026
The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting before outputting it on a public endpoint, and does not verify object ownership when the setting is saved, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any visitor viewing an affected filter.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/08/2026
The YMC Filter WordPress plugin vulnerability represents a critical cross-site scripting flaw that undermines the security boundaries of content management systems. This issue affects versions prior to 3.12.8 and demonstrates a classic failure in input validation and access control mechanisms. The vulnerability stems from improper sanitization and escaping of user-provided data within the layout builder functionality, creating an avenue for persistent XSS attacks that can compromise any website visitor.
The technical flaw manifests in the plugin's handling of settings data through a public endpoint that outputs content without adequate sanitization measures. Specifically, when users with contributor roles or higher save layout builder configurations, the system fails to verify ownership or properly escape potentially malicious input before rendering it on publicly accessible pages. This design oversight creates a persistent XSS vector where attackers can inject JavaScript code that executes in the browser context of any visitor who accesses the affected filter page.
The operational impact of this vulnerability extends beyond simple data theft or defacement, as it enables attackers to execute arbitrary JavaScript code within the browsers of legitimate users. This capability allows for session hijacking, credential theft, redirection to malicious sites, and potential exploitation of browser vulnerabilities through the injected scripts. The fact that contributor-level users can exploit this weakness indicates a significant privilege escalation issue within the plugin's access control model, potentially allowing unauthorized users to compromise entire websites.
The vulnerability aligns with CWE-79 Cross-Site Scripting flaws and maps to ATT&CK technique T1566.001 Phishing via Social Media, as it enables attackers to craft malicious payloads that can be delivered to unsuspecting visitors. The plugin's failure to implement proper input validation and access control represents a fundamental breakdown in the principle of least privilege and data sanitization practices. Organizations using affected versions of this plugin face heightened risk of user compromise and potential lateral movement within their networks through the exploitation of this persistent XSS vulnerability.
Mitigation strategies must include immediate upgrade to version 3.12.8 or later, which addresses the sanitization and ownership verification issues. Additionally, administrators should implement network-level protections such as web application firewalls that can detect and block malicious script injection attempts. Regular security audits of WordPress plugins should be conducted to identify similar vulnerabilities in other third-party components, and access controls should be reviewed to ensure that only authorized users can modify critical layout settings. The vulnerability also underscores the importance of implementing Content Security Policy headers to limit script execution and prevent unauthorized code from running on affected websites.