CVE-2026-16558 is a CWE-79 Cross-Site Scripting vulnerability in the YMC Filter WordPress plugin versions including 3.6.0. The issue arises because the plugin does not properly sanitize and escape a layout builder setting before rendering it on a public endpoint. Additionally, it lacks verification of object ownership when the setting is saved. This combination allows authenticated users with Contributor or higher privileges to store malicious JavaScript code that executes in the context of any visitor viewing the affected filter, potentially leading to information disclosure or session hijacking.

The vulnerability allows users with Contributor role or above to inject and execute arbitrary JavaScript in the browsers of site visitors. This can lead to partial confidentiality and integrity impacts, such as theft of user session data or manipulation of displayed content. There is no impact on availability. The CVSS v3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, privileges required, user interaction required, and partial confidentiality and integrity impact.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict Contributor role permissions or avoid using affected versions. Monitor vendor channels for updates and apply official patches once available.