UNKNOWN NVD

CVE-2026-16559

The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privi

The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users, allowing users with the Author role and above to upload a file containing JavaScript that executes in the site's origin when the file is viewed.

References

https://wpscan.com/vulnerability/9b8d265a-542f-4e1b-966d-3fc3dbf7a800/

Published: 2026-08-08 · Source: NVD · Feed updated: 2026-08-10

This unknown severity vulnerability was published on 2026-08-08 via NVD.

vulnfeed aggregates 8893 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.