YMC Filter CVE-2026-16558

Exploitation requires the attacker to hold at minimum a Contributor-level WordPress account on the target site (confirmed by PR:L in the CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). The YMC Filter plugin must be installed and active in a vulnerable version (3.6.0 to 3.12.7). For the XSS payload to execute, a victim site visitor must load the public page or endpoint containing the affected filter output (UI:R). Sites that disable open user registration or restrict the Contributor role to trusted internal staff are not exposed to external attackers. No special network position, elevated privileges, or non-default WordPress configuration beyond an active Contributor account and the vulnerable plugin version is required.

The CVSS 5.4 Medium rating is consistent with a stored XSS requiring low-privilege authentication, victim interaction, and producing limited confidentiality and integrity impact with a scope change - an accurate calibration for this vulnerability class. The EPSS score of 0.15% at the 5th percentile indicates very low probability of in-the-wild exploitation relative to the overall CVE population; however, this sits in tension with the confirmed availability of a public proof-of-concept via WPScan, which mechanically lowers exploitation effort once an attacker holds a Contributor account. The CVE is not listed in CISA KEV, so active exploitation at scale is not confirmed. For practical prioritization, even a mid-sized municipal IT team in radom managing a public-facing WordPress site with open contributor registration should treat this as a moderate-urgency patch rather than an emergency, because the requirement for an authenticated Contributor account substantially constrains the attacker pool on tightly managed sites. Sites with open user registration allowing contributor access face meaningfully higher real-world risk and should prioritize patching or access restriction immediately.

An attacker registers or obtains a Contributor-level WordPress account on a target site running YMC Filter 3.6.0-3.12.7, then navigates to the layout builder settings and saves a crafted JavaScript payload - such as a cookie-stealing script - into a filter configuration field without needing to own that object. The payload is stored server-side and rendered unsanitized on the public filter endpoint; any visitor whose browser loads that page executes the attacker's script, potentially exposing session cookies or redirecting users to malicious destinations. A public proof-of-concept is available via WPScan, reducing the technical skill required to carry out this attack.