Stored DOM-Based Cross-Site Scripting Vulnerability in YMC Filter Plugin for WordPress

CVE-2026-109983

What is CVE-2026-109983?

The YMC Filter plugin for WordPress suffers from a vulnerability allowing Stored DOM-Based Cross-Site Scripting. This issue is triggered via the 'post_title' parameter, which lacks proper input sanitization and output escaping. Authenticated attackers with author-level permissions can exploit this flaw to inject arbitrary web scripts into pages, affecting any user who accesses the altered content. Furthermore, because the autocomplete REST endpoint is improperly configured to authorize all visitors indiscriminately, even unauthenticated users can activate the malicious payload by interacting with the search box. This vulnerability poses significant risks to site integrity and user security.

References