{
 "id": "WPSEC-2026-1202",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1202/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1202/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1202/index.md",
 "title": "YMC Filter <= 3.12.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Autocomplete Search Results",
 "description": "The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the search autocomplete suggestions in all versions up to, and including, 3.12.19, due to insufficient output escaping. Post titles were only stripped of tags and then placed inside an HTML attribute that was built as a string and written with innerHTML, so a double quote in a title could break out of the attribute. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts through a post title. The scripts run in a user's browser when the post appears in the autocomplete suggestions for that user's search.",
 "plugin": {
  "slug": "ymc-smart-filter",
  "name": "YMC Filter",
  "full_name": "YMC Filter",
  "wordpress_org": "https://wordpress.org/plugins/ymc-smart-filter/",
  "advisories_url": "https://wpsec.com/vuln/plugin/ymc-smart-filter/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/ymc-smart-filter"
 },
 "type": "XSS",
 "cwe": [
  "CWE-79"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "3.12.20",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 3.12.20"
  ]
 },
 "introduced_in": null,
 "fixed_in": "3.12.20",
 "remediation": "Update to 3.12.20 or later.",
 "fix_released": "2026-10-16T16:04:02+00:00",
 "published": "2026-10-17T16:42:18+00:00",
 "updated": "2026-10-17T08:19:31.136429+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1202/",
  "https://plugins.svn.wordpress.org/ymc-smart-filter/tags/3.12.20/",
  "https://wordpress.org/plugins/ymc-smart-filter/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/ymc-smart-filter",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-10-17"
 }
}