CVE-2026-16559: CWE-79 Cross-Site Scripting (XSS) in YMC Filter
The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users, allowing users with the Author role and above to upload a file containing JavaScript that executes in the site's origin when the file is viewed.
AI Analysis
Technical Summary
CVE-2026-16559 is a CWE-79 Cross-Site Scripting vulnerability in the YMC Filter WordPress plugin versions prior to 3.12.9. The plugin fails to sanitize SVG files uploaded through its icon upload feature, permitting low-privileged users (Author role and above) to upload SVG files containing JavaScript. This JavaScript executes in the site's origin when the SVG file is viewed, enabling potential compromise of confidentiality, integrity, and availability of the site.
Potential Impact
Successful exploitation allows an attacker with Author-level privileges to execute arbitrary JavaScript in the context of the vulnerable website. This can lead to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability of the site.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict upload permissions to trusted users only and avoid allowing Author role users to upload SVG files. Monitor for updates from the vendor regarding a patch or official mitigation.
CVE-2026-16559: CWE-79 Cross-Site Scripting (XSS) in YMC Filter
Description
The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users, allowing users with the Author role and above to upload a file containing JavaScript that executes in the site's origin when the file is viewed.
CVSS v3.1
Score 6.8medium
Affected software
YMC Filter
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-16559 is a CWE-79 Cross-Site Scripting vulnerability in the YMC Filter WordPress plugin versions prior to 3.12.9. The plugin fails to sanitize SVG files uploaded through its icon upload feature, permitting low-privileged users (Author role and above) to upload SVG files containing JavaScript. This JavaScript executes in the site's origin when the SVG file is viewed, enabling potential compromise of confidentiality, integrity, and availability of the site.
Potential Impact
Successful exploitation allows an attacker with Author-level privileges to execute arbitrary JavaScript in the context of the vulnerable website. This can lead to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality, integrity, and availability of the site.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict upload permissions to trusted users only and avoid allowing Author role users to upload SVG files. Monitor for updates from the vendor regarding a patch or official mitigation.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-07-22T12:09:50.019Z
- State
- PUBLISHED
Threat ID: 6a76cc2abf8831d539114712
Added to database: 08/08/2026, 06:26:50 UTC
Last enriched: 08/15/2026, 14:59:41 UTC
Last updated: 09/22/2026, 01:52:42 UTC
Views: 28
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.