YMC Filter <= 3.12.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Autocomplete Search Results
- ID
- WPSEC-2026-1202
- Plugin
- YMC Filter (ymc-smart-filter)
- Affected
- all versions before 3.12.20
- Remediation
- Update to 3.12.20 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-79
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-17
- Attack surface
- YMC Filter on WPSec AttackSurface
- Fix released
- Published
Description
The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the search autocomplete suggestions in all versions up to, and including, 3.12.19, due to insufficient output escaping. Post titles were only stripped of tags and then placed inside an HTML attribute that was built as a string and written with innerHTML, so a double quote in a title could break out of the attribute. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts through a post title. The scripts run in a user's browser when the post appears in the autocomplete suggestions for that user's search.
References
- https://wpsec.com/vuln/WPSEC-2026-1202/
- https://plugins.svn.wordpress.org/ymc-smart-filter/tags/3.12.20/
- https://wordpress.org/plugins/ymc-smart-filter/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS