CVE-2026-16559 Overview
CVE-2026-16559 affects the YMC Filter WordPress plugin in versions prior to 3.12.9. The plugin fails to sanitize Scalable Vector Graphics (SVG) files uploaded through one of its icon upload features. It also permits uploads by low-privileged users. Any account holding the Author role or higher can upload an SVG file containing JavaScript. That script executes in the site's origin when the file is viewed, resulting in stored Cross-Site Scripting (XSS) [CWE-79].
Critical Impact
Authenticated users with Author-level permissions or above can plant persistent JavaScript that runs in the browser of any visitor or administrator who views the uploaded SVG, enabling session theft and administrative account takeover.
Affected Products
- YMC Filter WordPress plugin versions before 3.12.9
- WordPress installations that grant untrusted users the Author role or higher
- Sites configured to serve uploaded SVG files inline
Discovery Timeline
- 2026-08-08 - CVE-2026-16559 published to the National Vulnerability Database
- 2026-08-11 - Last updated in NVD database
Technical Details for CVE-2026-16559
Vulnerability Analysis
The YMC Filter plugin exposes an icon upload feature intended for adding graphical assets to filter widgets. The upload handler accepts SVG files without stripping embedded scripting content. SVG is an XML-based format that natively supports <script> elements and JavaScript event handlers such as onload. When a browser renders the uploaded SVG inline, the embedded JavaScript executes within the security context of the WordPress site's origin.
The plugin also fails to enforce a sufficient capability check on the upload endpoint. Users assigned the Author role, who normally cannot upload arbitrary HTML or scripts, gain the ability to introduce executable content through this feature. The stored payload persists until an administrator removes the file, and it triggers each time the resource is loaded.
Root Cause
Two defects combine to produce the vulnerability. First, the upload routine omits SVG sanitization, allowing scripts and event handlers to survive the upload pipeline. Second, the capability check permits Author-level accounts to invoke a feature that should be restricted to administrators. Together these gaps convert a routine content contributor account into a stored XSS delivery channel.
Attack Vector
An attacker first authenticates to the target site using an Author, Editor, or higher role account. The attacker then submits a crafted SVG file to the plugin's icon upload endpoint. The SVG carries a <script> block or an event handler that references attacker-controlled JavaScript. When a victim, typically an administrator, browses to a page or media resource that renders the SVG, the script executes with the victim's session. The payload can exfiltrate authentication cookies, create new administrator accounts, or modify site content.
See the WPScan Vulnerability Report for the technical writeup.
Detection Methods for CVE-2026-16559
Indicators of Compromise
- SVG files in the WordPress uploads directory containing <script> tags, onload attributes, or javascript: URIs.
- New WordPress administrator accounts created shortly after an SVG upload event by a non-administrator user.
- Outbound requests from browsers viewing WordPress admin pages to unfamiliar external domains carrying session cookies.
Detection Strategies
- Scan the wp-content/uploads directory for SVG files and inspect their XML for scripting constructs.
- Review WordPress audit logs for icon uploads performed by accounts below the administrator role.
- Correlate SVG upload events with subsequent privilege changes or plugin installations in the same session.
Monitoring Recommendations
- Alert on HTTP POST requests to YMC Filter icon upload endpoints originating from Author or Editor sessions.
- Monitor for SVG responses served with Content-Type: image/svg+xml that contain script content.
- Track user role escalations and new administrator account creation as follow-on activity.
How to Mitigate CVE-2026-16559
Immediate Actions Required
- Upgrade the YMC Filter plugin to version 3.12.9 or later on all WordPress instances.
- Audit existing SVG files in the media library and remove any containing scripts or event handlers.
- Review Author and Editor accounts for recent additions and rotate credentials for suspicious users.
Patch Information
The vendor addressed the flaw in YMC Filter version 3.12.9. The fix sanitizes SVG uploads and restricts the icon upload feature to appropriately privileged users. Refer to the WPScan Vulnerability Report for advisory details.
Workarounds
- Disable the YMC Filter plugin until the upgrade to 3.12.9 or later is applied.
- Configure the web server to serve SVG files with Content-Disposition: attachment so browsers download rather than render them.
- Restrict user registration and demote unnecessary Author or Editor accounts to Contributor or Subscriber roles.
- Deploy a web application firewall rule that blocks SVG uploads containing <script> or on*= attributes.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
