The YMC Filter WordPress plugin, versions earlier than 3.12.8, fails to sanitize or escape a layout builder setting before rendering it on a public endpoint. It also neglects to verify that the user creating or updating the setting has ownership rights. As a result, any user who holds the Contributor role or higher can embed arbitrary JavaScript into that setting. When a site visitor loads a page that displays the affected filter, the injected script executes in the visitor’s browser, enabling attackers to steal cookies, deface the site, or perform phishing attacks. This is a stored cross‑site scripting flaw that also includes a privilege escalation aspect, because the attacker does not need administrative rights to inject malicious code.

Any WordPress site running the YMC Filter plugin prior to release 3.12.8 is vulnerable. The vulnerability is specific to the layout builder feature of the plugin. There is no alternative version number or product name; it applies to the plugin as distributed in the WordPress repository. Site administrators should verify whether the plugin is installed and determine its version.

The CVSS score of 5.4 classifies the vulnerability as moderate, reflecting the stored cross‑site scripting impact that requires only Contributor level access to exploit. The EPSS score of below 1% indicates a low likelihood of exploitation, while the absence of a KEV listing suggests no widespread attacks have been reported. The flaw can be exploited by any user with Contributor or higher privileges by embedding JavaScript into a layout builder setting; the malicious script then runs in the browsers of all visitors who view the affected filter, enabling cookie theft, defacement or phishing. The lack of proper input sanitization and ownership checks makes this risk significant for sites with active contributors who can modify filter settings.