CVE-2026-16559

The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users, allowing users with the Author role and above to upload a file containing JavaScript that executes in the site's origin when the file is viewed.

CVSS v3.1

6.8 MEDIUMCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

EPSS

0.23% chance of exploitation in the next 30 days, 14th percentile

Published

2026-08-08

Updated

2026-08-11

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/9b8d265a-542f-4e1b-966d-3fc3dbf7a800/

References

• CVE Record
• NVD entry

Related

• CVE-2026-16558
• CVE-2026-16561
• CVE-2026-16548
• CVE-2026-16562
• CVE-2026-16547
• CVE-2026-16563