medium5.4
CVE-2026-16558
The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting before outputting it on a public endpoint, and does not ver…
Impact
The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting before outputting it on a public endpoint, and does not verify object ownership when the setting is saved, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any visitor viewing an affected filter.
Affected products
| Product | Affected versions |
|---|---|
| YMC Filter WordPress Plugin | before 3.12.8 |
Versions were read from the advisory text. No structured product data has been published for this record yet.