CVE-2026-16559 — YMC Filter < 3.12.9 - Author+ Stored XSS via SVG Icon Upload
The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users, allo…
Published: 2026-08-08 · CVSS: 6.8 · CVSS 3.1
The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users, allowing users with the Author role and above to upload a file containing JavaScript that executes in the site's origin when the file is viewed.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7