The YMC Filter WordPress plugin allows stored DOM‑based XSS through the post_title parameter. An attacker with author or higher privileges can inject malicious script into this field; because the autocomplete REST endpoint is accessible to all visitors, any user, even unauthenticated, can trigger the payload by typing in the search box. The resulting script executes in the victim’s browser, enabling actions such as session hijacking, credential theft, or defacement. This flaw is a classic injection issue identified as CWE‑79.

All installations of the YMC Filter plugin with versions up to and including 3.12.19 are affected. The vendor is wssoffice21.

The CVSS score of 6.4 indicates moderate severity and the lack of an EPSS rating or KEV listing does not reduce the practical risk. Triggering the payload requires author‑level write access to store the malicious title, but the REST endpoint’s permissive callback means that any visitor can later cause the script to run. Once injected, the script executes automatically whenever the compromised page is visited, presenting a realistic threat to site users. Mitigation requires applying the vendor’s patch or otherwise preventing storage of untrusted data.