CVE-2026-16559CWE-79cross-site-scripting
CVE-2026-16559
Medium · published August 8, 2026
What it is
The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users, allowing users with the Author role and above to upload a file containing JavaScript that executes in the site's origin when the file is viewed.
The record
Technical detail
- CVSS v3.1
- 6.8 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
- CVSS v4.0
- Not supplied
- EPSS
- 0.00431 · 36.3th percentile
- Weakness
- CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- Published
- 2026-08-08T11:17Z
References (1)
EPSS history
Timeline