CVE-2026-16558

Name of the Vulnerable Software and Affected Versions YMC Filter versions prior to 3.12.8

Description The plugin fails to sanitize and escape a layout builder setting before it is output on a public endpoint. Additionally, the software does not verify object ownership when the setting is saved. This allows users with the Contributor role or higher to perform a Stored Cross-Site Scripting (XSS) attack—where malicious scripts are permanently stored on the server—by injecting JavaScript that executes in the browser of any visitor viewing an affected filter.

Recommendations Update YMC Filter to version 3.12.8 or later.