MEDIUM
wssoffice21
CVE published 2026-10-17
CVE-2026-109983
The YMC Filter plugin for WordPress has a Stored DOM-Based Cross-Site Scripting vulnerability via the 'post_title' parameter in all versions up to, and including, 3.12.19. This allows authenticated attackers with author-level access and above to inject arbitrary web scripts, which execute when a user accesses an injected page. The autocomplete REST endpoint is unconditionally accessible, allowing any site [truncated]