CVE-2026-109983: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in wssoffice21 YMC Filter

CVE-2026-109983 is a stored DOM-based cross-site scripting vulnerability in the YMC Filter plugin for WordPress (wssoffice21). The vulnerability exists due to insufficient input sanitization and output escaping of the 'post_title' parameter in all versions up to and including 3.12.19. Authenticated attackers with author-level permissions can inject arbitrary scripts that execute in the context of users visiting the affected pages. The autocomplete REST endpoint lacks proper permission checks, allowing any visitor, including unauthenticated users, to trigger the malicious payload via the search functionality.

An attacker with author-level access can inject persistent malicious scripts into pages, which execute in the browsers of users who view those pages. Because the autocomplete REST endpoint is accessible without authentication, any site visitor can trigger the execution of these scripts, potentially leading to theft of sensitive information or session hijacking. The vulnerability has a CVSS 3.1 base score of 6.4 (medium severity), indicating a significant risk but not critical. There are no known exploits in the wild at this time.

No official patch or fix is currently available for this vulnerability. Users should monitor the vendor's advisory for updates. In the meantime, restrict author-level access to trusted users only and consider disabling or limiting the use of the YMC Filter plugin until a fix is released. Avoid exposing the autocomplete REST endpoint publicly if possible.