CVE-2026-109983: YMC Filter Plugin XSS Vulnerability

CVE-2026-109983 Overview

CVE-2026-109983 is a Stored DOM-Based Cross-Site Scripting [CWE-79] vulnerability in the YMC Smart Filter plugin for WordPress. It affects all versions up to and including 3.12.19. The flaw resides in the handling of the post_title parameter, where insufficient input sanitization and output escaping allow authenticated attackers with Author-level access to persist arbitrary JavaScript. The payload executes in the browser of any site visitor who interacts with the YMC filter search box because the autocomplete REST endpoint uses a permission callback that unconditionally returns true.

Critical Impact
Author-level attackers can store JavaScript that executes in any visitor's browser, including unauthenticated users, enabling session theft, account takeover, and site defacement.

Affected Products

YMC Smart Filter plugin for WordPress — all versions through 3.12.19
WordPress sites exposing the plugin's frontend autocomplete REST endpoint
Fixed in YMC Smart Filter 3.12.20

Discovery Timeline

2026-10-17 - CVE-2026-109983 published to the National Vulnerability Database (NVD)
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-109983

Vulnerability Analysis

The vulnerability combines two weaknesses in the YMC Smart Filter plugin. First, the plugin stores the post_title field without adequate sanitization, allowing Author-level users to embed script content in post titles that the filter widget later consumes. Second, the frontend search controller returns that stored content to the client without proper escaping, and the client-side JavaScript injects the response into the DOM in a way that executes attacker-controlled markup.

Because the autocomplete endpoint is intended to serve public visitors, triggering the payload requires no authentication. Any visitor typing into the YMC filter search box issues a request to the vulnerable REST route, receives the poisoned autocomplete data, and executes the script in the context of the hosting site's origin.

Root Cause

The root cause is the combination of missing output escaping in the frontend search controller (see FG_REST_Frontend_Search_Controller.php lines 135 and 148) and a REST permission callback in FG_REST_Abstract_Controller.php that returns true unconditionally. The result is a REST route with no access control serving unsanitized stored data to the DOM-injection logic in ymc-public.min.js.

Attack Vector

An attacker authenticates to the WordPress site with at least Author privileges and creates or edits a post whose title contains a JavaScript payload. The payload is persisted to the database. When any visitor loads a page that renders the YMC filter and interacts with its search box, the autocomplete REST endpoint returns the attacker's title string, and the frontend script writes it into the DOM where it executes. The scope-changed impact enables theft of session cookies, forced actions on behalf of visitors, and injection of secondary payloads.

See the Wordfence Vulnerability Analysis and the WordPress YMC Frontend Search Controller source for technical references.

Detection Methods for CVE-2026-109983

Indicators of Compromise

Post titles containing HTML tags, <script>, onerror=, onload=, javascript: URIs, or encoded script fragments.
HTTP requests to the plugin's autocomplete REST route returning JSON payloads with HTML or script markup in title fields.
Unexpected outbound requests from visitor browsers to attacker-controlled domains originating from pages that embed the YMC filter.

Detection Strategies

Inspect the wp_posts table for post_title values that contain HTML or JavaScript syntax, especially from Author-role accounts.
Monitor WordPress REST traffic for requests to the YMC autocomplete endpoint and alert on responses whose payloads contain <, >, or event-handler attributes.
Deploy a web application firewall rule that blocks script-like content submitted to post title fields by non-administrator roles.

Monitoring Recommendations

Enable WordPress audit logging for post creation and update events performed by Author-level accounts.
Capture browser Content Security Policy (CSP) violation reports from pages hosting the YMC filter widget.
Baseline the installed plugin version across the WordPress estate and alert on any instance pinned below 3.12.20.

How to Mitigate CVE-2026-109983

Immediate Actions Required

Update the YMC Smart Filter plugin to version 3.12.20 or later on every WordPress site in the environment.
Audit Author-and-above accounts, rotate credentials for any unverified accounts, and remove unused author access.
Review existing posts for malicious post_title content and sanitize or remove any entries containing script payloads.

Patch Information

The vendor addressed the issue in YMC Smart Filter 3.12.20. The fix is visible in the WordPress YMC Frontend Search Controller Update. Site operators can obtain the update from the YMC Smart Filter Plugin Page.

Workarounds

Deactivate the YMC Smart Filter plugin until the patched version can be installed.
Restrict Author-level publishing to trusted users and enforce multi-factor authentication for all content contributors.
Deploy a strict Content Security Policy that disallows inline script execution on pages rendering the filter widget.

bash

# Update the YMC Smart Filter plugin via WP-CLI
wp plugin update ymc-smart-filter --version=3.12.20

# Verify the installed version
wp plugin get ymc-smart-filter --field=version