CVE-2026-16559
Received Received - Intake

SVG File Upload Leading to Stored XSS in YMC Filter WordPress Plugin

Publication date: 2026-08-08

Last updated on: 2026-08-08

Assigner: WPScan

Description
The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users, allowing users with the Author role and above to upload a file containing JavaScript that executes in the site's origin when the file is viewed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-08
Last Modified
2026-08-08
Generated
2026-08-08
AI Q&A
2026-08-08
EPSS Evaluated
N/A
NVD
CVE-2026-16559
EUVD
EUVD-2026-54734

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ymc_filter ymc_filter to 3.12.9 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The YMC Filter WordPress plugin before version 3.12.9 has a stored cross-site scripting (XSS) vulnerability. It allows users with Author role or higher to upload SVG files containing malicious JavaScript without proper sanitization. When these files are viewed, the embedded script executes in the site's origin.

Detection Guidance

Check WordPress plugin versions for YMC Filter. If the version is below 3.12.9, the system is vulnerable. Look for unauthorized SVG uploads in media libraries, especially those containing JavaScript code.

Impact Analysis

An attacker could exploit this to inject malicious scripts into your WordPress site. This could lead to unauthorized actions on behalf of users, theft of sensitive data, or defacement of your website. The impact depends on user privileges and site configuration.

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR and HIPAA requirements for data protection and security. Non-compliance risks include fines and legal penalties depending on the jurisdiction and affected data.

Mitigation Strategies

Update the YMC Filter plugin to version 3.12.9 or later immediately. Remove any suspicious SVG files from the media library. Review user roles to ensure only trusted users have Author privileges or higher.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16559. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart