CVE-2026-109983: YMC Filter <= 3.12.19 - Authenticated (Author+) Stored DOM-Based Cross-Site Scripting via 'post_title' Parameter
The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'posttitle' parameter in all versions up to, and including, 3.12.19 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The autocomplete REST endpoint is registered with a permission callback that unconditionally returns true, meaning any site visitor — including unauthenticated users — can trigger the payload simply by typing in the YMC filter search box, while only Author-level access is required to store it.
Affected Software
Event History
Frequently Asked Questions
Who can store a malicious payload, and who can trigger it?
An authenticated user with Author-level WordPress access or higher can store the payload through the post_title parameter. Any visitor, including an unauthenticated user, can trigger it by typing in the YMC filter search box on an affected page.
Are sites affected if visitors do not log in?
Yes. Authentication is required to inject and store the payload, but not to execute it once it has been stored. The autocomplete REST endpoint's permission callback always returns true, allowing unauthenticated visitors to invoke the vulnerable behavior.
Which versions are affected?
All YMC Filter versions up to and including 3.12.19 are affected.