# YMC Filter <= 3.12.19 - Authenticated (Contributor+) Stored Cross-Site Scripting via Autocomplete Search Results

- **ID:** WPSEC-2026-1202
- **Plugin:** YMC Filter (`ymc-smart-filter`), https://wordpress.org/plugins/ymc-smart-filter/
- **Affected versions:** all versions before 3.12.20
- **Fixed in:** 3.12.20 (Update to 3.12.20 or later.)
- **Severity:** Medium 6.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-79
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-17)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/ymc-smart-filter
- **Fix released:** 2026-10-16
- **Published:** 2026-10-17
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1202/

## Description

The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the search autocomplete suggestions in all versions up to, and including, 3.12.19, due to insufficient output escaping. Post titles were only stripped of tags and then placed inside an HTML attribute that was built as a string and written with innerHTML, so a double quote in a title could break out of the attribute. This makes it possible for authenticated attackers with contributor-level access and above to inject arbitrary web scripts through a post title. The scripts run in a user's browser when the post appears in the autocomplete suggestions for that user's search.

## References

- https://wpsec.com/vuln/WPSEC-2026-1202/
- https://plugins.svn.wordpress.org/ymc-smart-filter/tags/3.12.20/
- https://wordpress.org/plugins/ymc-smart-filter/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1202/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.