XSS in Ymc Filter
CVE-2026-16558
The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting before outputting it on a public endpoint, and does not verify object ownership when the setting is saved, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any visitor viewing an affected filter.
Vulnerability class: XSS (Cross-Site Scripting)
EPSS: 0.001 (2.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.4 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Affected products
- Unknown Ymc Filter — versions 3.6.0
Weakness classification (CWE)
References
- contact@wpscan.com (technical-description, exploit, vdb-entry)
Frequently asked questions
- What is CVE-2026-16558?
- CVE-2026-16558 is a medium-severity vulnerability in Ymc Filter, classified under Cross-site Scripting. CVSS score: 5.4/10. Published 2026-08-08.
- How severe is CVE-2026-16558?
- Medium severity. CVSS v3 base score is 5.4 out of 10.