The YMC Filter WordPress plugin versions before 3.12.8 contain a CWE-79 Cross-Site Scripting vulnerability. This occurs because the plugin does not properly sanitize or escape a layout builder setting before rendering it publicly. Furthermore, it lacks verification of object ownership when saving this setting. As a result, users with Contributor role or above can store malicious JavaScript code that executes in the context of any visitor viewing the affected filter, potentially leading to session hijacking or other client-side attacks.

An attacker with Contributor or higher privileges can inject arbitrary JavaScript into a public endpoint of the plugin. This script executes in the browsers of any visitors to the affected filter, potentially allowing theft of cookies, session tokens, or other malicious actions executed in the victim's browser context. The vulnerability could be leveraged to compromise site visitors but requires authenticated access at Contributor level or above.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict Contributor and higher roles to trusted users only, and monitor for suspicious activity related to the YMC Filter plugin. Avoid exposing the vulnerable plugin publicly if possible.