CVE-2026-16559: CWE-79 Cross-Site Scripting (XSS) in YMC Filter
The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users, allowing users with the Author role and above to upload a file containing JavaScript that executes in the site's origin when the file is viewed.
AI Analysis
Technical Summary
The YMC Filter WordPress plugin versions prior to 3.12.9 allow low-privileged users (Author role and above) to upload SVG files without proper sanitization. These SVG files can contain embedded JavaScript, which executes in the site's origin when accessed, resulting in a Cross-Site Scripting (CWE-79) vulnerability. This flaw arises from insufficient input validation and sanitization of uploaded SVG content in the icon upload feature.
Potential Impact
Users with Author role or higher can upload malicious SVG files containing JavaScript that executes in the context of the website. This can lead to client-side script execution, potentially enabling session hijacking, defacement, or other attacks that rely on executing arbitrary JavaScript in the victim's browser. The vulnerability affects the confidentiality and integrity of users interacting with the affected site.
Mitigation Recommendations
No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict the ability to upload SVG files to trusted users only or disable the icon upload feature if possible.
CVE-2026-16559: CWE-79 Cross-Site Scripting (XSS) in YMC Filter
Description
The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users, allowing users with the Author role and above to upload a file containing JavaScript that executes in the site's origin when the file is viewed.
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The YMC Filter WordPress plugin versions prior to 3.12.9 allow low-privileged users (Author role and above) to upload SVG files without proper sanitization. These SVG files can contain embedded JavaScript, which executes in the site's origin when accessed, resulting in a Cross-Site Scripting (CWE-79) vulnerability. This flaw arises from insufficient input validation and sanitization of uploaded SVG content in the icon upload feature.
Potential Impact
Users with Author role or higher can upload malicious SVG files containing JavaScript that executes in the context of the website. This can lead to client-side script execution, potentially enabling session hijacking, defacement, or other attacks that rely on executing arbitrary JavaScript in the victim's browser. The vulnerability affects the confidentiality and integrity of users interacting with the affected site.
Mitigation Recommendations
No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict the ability to upload SVG files to trusted users only or disable the icon upload feature if possible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-07-22T12:09:50.019Z
- Cvss Version
- null
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a76cc2abf8831d539114712
Added to database: 08/08/2026, 06:26:50 UTC
Last enriched: 08/08/2026, 06:48:02 UTC
Last updated: 08/09/2026, 00:41:12 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.