CVE-2026-16558 Overview
CVE-2026-16558 is a stored Cross-Site Scripting (XSS) vulnerability in the YMC Filter WordPress plugin before version 3.12.8. The plugin fails to sanitize and escape a layout builder setting before rendering it on a public endpoint. It also does not verify object ownership when the setting is saved. Users with the Contributor role or higher can store arbitrary JavaScript that executes in the browser of any visitor viewing an affected filter. The flaw maps to [CWE-79] and requires low-privileged authentication plus user interaction to trigger against a victim. This weakness enables session theft, redirection, and drive-by actions performed under the victim's browser context.
Critical Impact
Authenticated contributors can inject persistent JavaScript that runs in every visitor's browser, enabling account takeover and content manipulation on affected WordPress sites.
Affected Products
- YMC Filter WordPress plugin versions prior to 3.12.8
- WordPress installations that expose filter endpoints publicly
- Multi-author WordPress sites granting the Contributor role or above
Discovery Timeline
- 2026-08-08 - CVE-2026-16558 published to the National Vulnerability Database (NVD)
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-16558
Vulnerability Analysis
The vulnerability is a persistent Cross-Site Scripting flaw in the plugin's layout builder configuration. The plugin stores a layout builder setting supplied by an authenticated user and later emits it into HTML on a public-facing endpoint. Because the value is neither sanitized on input nor escaped on output, embedded <script> tags and inline event handlers execute in a visitor's browser. Compounding the issue, the save handler does not verify that the acting user owns the object being modified. A Contributor can therefore tamper with layout settings attached to other authors' content. The exploit executes in the site's origin, allowing an attacker to read cookies not flagged HttpOnly, invoke administrative AJAX endpoints, or pivot to further compromise.
Root Cause
Two defects combine to produce the impact. First, the layout builder setting is written to storage and echoed to the response without calling WordPress escaping helpers such as esc_html, esc_attr, or wp_kses. Second, the save routine lacks an ownership check comparing the acting user against the object owner. The result is a broken access control condition layered on top of an output encoding failure.
Attack Vector
An attacker first authenticates as a Contributor or higher. They submit a crafted layout builder setting containing JavaScript through the plugin's save endpoint. When any visitor, including administrators, loads a page that renders the affected filter, the payload executes in their browser. The attack requires user interaction only in the sense that a victim must load a page containing the filter.
See the WPScan Vulnerability Details for additional technical context.
Detection Methods for CVE-2026-16558
Indicators of Compromise
- Layout builder settings containing <script> tags, javascript: URIs, or inline event handlers such as onerror and onload
- Unexpected outbound requests from visitor browsers to attacker-controlled domains sourced from pages rendering YMC filters
- Contributor accounts modifying layout builder objects owned by other authors in the WordPress audit trail
- New or modified administrator accounts following visits by privileged users to filter pages
Detection Strategies
- Review wp_postmeta and plugin option tables for YMC Filter layout entries containing HTML or script markers
- Correlate WordPress REST or admin-ajax requests from Contributor accounts saving layout builder settings with subsequent public page renders
- Deploy a web application firewall (WAF) rule to alert on HTML entities in fields that should contain only structured layout data
Monitoring Recommendations
- Enable WordPress activity logging to capture plugin option changes and post meta modifications by role
- Monitor Content Security Policy (CSP) violation reports for inline script executions on pages that host filters
- Alert on Contributor-level accounts editing objects they do not own
How to Mitigate CVE-2026-16558
Immediate Actions Required
- Update the YMC Filter plugin to version 3.12.8 or later on all WordPress installations
- Audit existing layout builder settings for stored HTML or JavaScript payloads and remove suspicious entries
- Rotate session cookies and administrator passwords if evidence of exploitation exists
- Review Contributor and Author accounts, disabling any that are unused or unrecognized
Patch Information
The vendor addressed CVE-2026-16558 in YMC Filter version 3.12.8. The fix introduces sanitization and escaping for layout builder settings and adds object ownership verification on save. Refer to the WPScan Vulnerability Details for the fixed version reference.
Workarounds
- Restrict the Contributor role from accessing the YMC Filter layout builder using a capability management plugin
- Deploy a WAF rule that blocks HTML tags and JavaScript URI schemes in requests to the plugin's save endpoint
- Enforce a strict Content Security Policy that disallows inline scripts on pages rendering YMC filters
- Temporarily deactivate the YMC Filter plugin until the patched version is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
