CVE-2026-16558: YMC Filter < 3.12.8 - Contributor+ Stored XSS via Layout Builder Schema
The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting before outputting it on a public endpoint, and does not verify object ownership when the setting is saved, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any visitor viewing an affected filter.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16558?
CVE-2026-16558 has a risk score of 43.
How do I fix CVE-2026-16558?
To mitigate CVE-2026-16558, upgrade the YMC Filter plugin to version 3.12.8 or later.
What type of vulnerability is CVE-2026-16558?
CVE-2026-16558 is classified as a stored cross-site scripting (XSS) vulnerability.
Who is affected by CVE-2026-16558?
CVE-2026-16558 affects users with the Contributor role and above on WordPress sites using the YMC Filter plugin.
What causes CVE-2026-16558?
CVE-2026-16558 is caused by insufficient sanitization and escaping of user inputs in the layout builder settings.