CVE-2026-109983 wssoffice21 CVE debrief

Who should care

Defenders responsible for WordPress installations using the YMC Filter plugin, especially those with user roles allowing author-level access and above, should assess exposure and prioritize verification and potential remediation.

Why it matters

CVE-2026-109983 is a Stored DOM-Based Cross-Site Scripting vulnerability in the YMC Filter plugin for WordPress. Defenders should verify exposure, assess user roles, and prioritize remediation based on the CVSS score and potential exploitation risks.

• Defenders need to verify if their WordPress installations are using vulnerable versions of the YMC Filter plugin.
• Exposure could allow attackers to inject malicious scripts, potentially leading to unauthorized actions or information disclosure.
• Defenders should assess user roles and access levels to determine potential exposure to this vulnerability.
• Remediation priority is medium due to the CVSS score of 6.4 and the potential for exploitation by authenticated attackers.

Technical summary

The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'post_title' parameter in all versions up to, and including, 3.12.19. The vulnerability is due to insufficient input sanitization and output escaping. Authenticated attackers with author-level access and above can inject arbitrary web scripts, which execute when a user accesses an injected page. The autocomplete REST endpoint allows any site visitor to trigger the payload by searching in the YMC filter search box.

Defensive priority

Defenders should prioritize verifying the presence of this vulnerability in their WordPress installations, especially if the YMC Filter plugin is used, and assess exposure based on user roles and access levels.

Recommended defensive actions

• Verify the presence of the YMC Filter plugin in your WordPress installation and check if the version is 3.12.19 or earlier.
• Assess user roles and access levels to determine potential exposure to this vulnerability.
• Consider updating the YMC Filter plugin to a version that addresses this vulnerability, if available.
• Monitor for potential exploitation attempts targeting this vulnerability.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and references to source code and additional information. The YMC Filter plugin for WordPress has a Stored DOM-Based Cross-Site Scripting vulnerability via the 'post_title' parameter in all versions up to, and including, 3.12.19. This allows authenticated attackers with author-level access and above to inject arbitrary web scripts, which execute when a user accesses an injected page. The autocomplete REST endpoint is uncondtionaly

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.