EUVD-2026-54733
GHSA-p3q7-6w8f-v63h
Severity by source
AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Contributor authentication required (PR:L), victim must load the page (UI:R), payload escapes to visitor browser context (S:C), with limited credential/session theft and DOM manipulation impact (C:L/I:L) and no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting before outputting it on a public endpoint, and does not verify object ownership when the setting is saved, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any visitor viewing an affected filter.
AnalysisAI
Stored cross-site scripting in the YMC Filter WordPress plugin (versions 3.6.0 through 3.12.7) enables any Contributor-level authenticated user to persistently inject arbitrary JavaScript into layout builder settings, which then executes in every site visitor's browser via an unsanitized public endpoint. The plugin compounds the flaw by failing to verify object ownership when saving layout settings, meaning low-privilege users can overwrite settings they do not control. A public proof-of-concept is available via WPScan; the vulnerability is patched in version 3.12.8.
Technical ContextAI
YMC Filter is a WordPress plugin (CPE: cpe:2.3:a:unknown:ymc_filter:*:*:*:*:*:*:*:*) that provides filter and layout builder functionality for WordPress front-ends. The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS): user-supplied input to the layout builder settings is persisted to the database without sanitization and subsequently reflected without escaping on a publicly accessible endpoint, allowing injected scripts to execute in the browser context of visiting users. The CVSS scope change (S:C) confirms the payload escapes the plugin's own context to affect third-party visitors. A secondary weakness is the absence of object ownership verification on the save action, which means any Contributor or higher can modify filter settings they do not own - this expands the attack surface beyond normal contributor content boundaries.
RemediationAI
The primary fix is to upgrade the YMC Filter WordPress plugin to version 3.12.8 or later, which introduces proper sanitization and output escaping of layout builder settings and enforces object ownership checks on save operations. Administrators can apply the update via the WordPress dashboard under Plugins > Installed Plugins, or via WP-CLI with wp plugin update ymc-filter. If immediate patching is not feasible, restrict the Contributor role from untrusted or externally registered users, which eliminates the attack surface for external actors - note this may limit legitimate editorial workflows. Alternatively, temporarily deactivating the YMC Filter plugin removes the vulnerable endpoint entirely, at the cost of disabling filter functionality site-wide. The WPScan advisory at https://wpscan.com/vulnerability/06ba0551-deab-41fb-b501-eef0727b431a/ provides additional remediation context.
More in Ymc Filter
View allSQL injection in the YMC Filter (YMC Smart Filter / Filter Grids) WordPress plugin lets remote attackers inject maliciou
Information disclosure in the YMC Filter WordPress plugin before 3.11.3 lets unauthenticated remote attackers read the t
Stored cross-site scripting in the YMC Filter WordPress plugin (all versions before 3.12.9) allows Author-role users to
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today