EUVD-2026-54734
GHSA-qgw2-v7vq-9g5r
Severity by source
AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
Author role is low privilege (PR:L); stored XSS impacts victim's browser context (S:C); impact limited to session/DOM (C:L/I:L); no server-side availability loss.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users, allowing users with the Author role and above to upload a file containing JavaScript that executes in the site's origin when the file is viewed.
AnalysisAI
Stored cross-site scripting in the YMC Filter WordPress plugin (all versions before 3.12.9) allows Author-role users to upload malicious SVG files whose embedded JavaScript executes in the browsers of any site user - including administrators - who views the file. A publicly available proof-of-concept exploit exists via WPScan, lowering the skill bar significantly for attackers who already hold an Author-level account. The EPSS score of 0.15% (5th percentile) indicates negligible automated exploitation activity, placing real-world risk primarily in multi-author WordPress environments where untrusted contributors hold Author-level access.
Technical ContextAI
YMC Filter is a WordPress filtering plugin that exposes an icon upload feature accessible to Author-role users and above. The root cause is CWE-79 (Cross-site Scripting): the plugin fails to sanitize SVG files prior to storage and serving. SVG is an XML-based vector format that natively supports embedded JavaScript via script elements and event handlers - when served directly from a web origin, the script inherits the full trust of that origin, enabling session hijacking and arbitrary DOM manipulation. The affected scope per CPE (cpe:2.3:a:unknown:ymc_filter:*:*:*:*:*:*:*:*) covers all plugin versions from 0 up to but not including 3.12.9. Because WordPress Author accounts can upload media by default, no non-default configuration is required to create the upload condition.
RemediationAI
Update the YMC Filter WordPress plugin to version 3.12.9 or later, the vendor-released patch confirmed by WPScan (https://wpscan.com/vulnerability/9b8d265a-542f-4e1b-966d-3fc3dbf7a800/). Prior to patching, administrators can use a role management plugin (such as Members or User Role Editor) to revoke media upload capability from the Author role - note this may break legitimate plugin icon upload functionality and should be tested. A second workaround is to block direct browser access to SVG files served from the WordPress uploads directory via server configuration (e.g., adding a Content-Disposition: attachment header for .svg files in nginx or Apache), which prevents inline script execution even if a malicious SVG is uploaded; this carries no functional impact on most site features. Sites where all Author-level-and-above accounts are fully trusted face negligible residual risk.
More in Ymc Filter
View allSQL injection in the YMC Filter (YMC Smart Filter / Filter Grids) WordPress plugin lets remote attackers inject maliciou
Information disclosure in the YMC Filter WordPress plugin before 3.11.3 lets unauthenticated remote attackers read the t
Stored cross-site scripting in the YMC Filter WordPress plugin (versions 3.6.0 through 3.12.7) enables any Contributor-l
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today