YMC Smart Filter CVE-2026-109983

Storing the payload requires an authenticated account with Author-level capability or higher on the target WordPress site, and the YMC Smart Filter plugin (≤3.12.19) must be installed and active. Triggering the stored payload requires NO authentication and NO special configuration: because the autocomplete REST search endpoint (FG_REST_Frontend_Search_Controller) is registered with a permission callback that unconditionally returns true, any visitor - including unauthenticated users - executes the script merely by typing into the YMC filter search box on a page that surfaces the injected post_title. The primary limiting factor is the Author-level write prerequisite, which restricts who can plant the payload; sites that do not grant untrusted users Author access are substantially less exposed.

This is a moderate-priority, not high-urgency issue. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N, base 6.4) reflects a network-reachable, low-complexity stored XSS where storing the payload requires authenticated Author-level privileges (PR:L) and a scope change (S:C) because the script executes in other users' browser contexts. The notable aggravating factor from the description is that the autocomplete REST endpoint uses a permission callback that unconditionally returns true, so any unauthenticated visitor can TRIGGER the stored payload by using the filter search box - the authentication barrier applies only to planting the payload, not to firing it. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so this is 'no public exploit identified at time of analysis.' The Author-level prerequisite meaningfully limits the attacker population to users who already have content-creation trust on the site, which is why real-world risk is lower than the CVSS might suggest for a self-hosted single-author blog, but higher for multi-author or membership sites where Author accounts are granted liberally. Impacts are limited (C:L/I:L, A:N) - consistent with typical XSS session/credential and content-manipulation effects rather than full compromise. Overall: a real, patchable vulnerability worth remediating, but it is privilege-gated and shows no evidence of active or automated exploitation.

On a multi-author WordPress site, an attacker with an Author account edits a post and injects a malicious script into the post_title field, which the plugin stores without sanitization. Later, any site visitor - including unauthenticated ones - types into the YMC filter search box, the autocomplete REST endpoint (open to everyone via its always-true permission callback) returns the unescaped title, and the DOM-based script executes in the victim's browser. No public exploit code is identified in the provided data.