Executive brief
YMC Filter is a WordPress plugin that allows administrators to create custom product filters. The plugin's icon upload feature fails to properly sanitize SVG files, allowing users with Author role and above to upload malicious SVG files containing JavaScript. When a victim views the uploaded SVG file in a browser, the JavaScript executes in the site's context, potentially stealing session data, performing unauthorized actions, or compromising the site's integrity.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the YMC Filter plugin's SVG icon upload handler. The plugin attempts to sanitize SVG uploads using regex-based filtering, but the sanitizer is bypassable through nested tag injection (e.g., <scr<script></script>ipt>) or UTF-16 encoding, allowing malicious script tags to survive the sanitization routine. The vulnerable REST endpoint (/ymc/v1/admin/terms/icon) requires Author role or above but performs insufficient output encoding. An authenticated attacker can upload a crafted SVG file containing JavaScript; when any user (including administrators or site visitors) views the file, the script executes in the site's origin, bypassing same-origin policy boundaries. The issue is fixed in version 3.12.9.
Affected products
- YMC Filter before 3.12.9
Timeline
- 2026-08-03: disclosed
- 2026-08-03: patched: Fixed in version 3.12.9