The YMC Filter WordPress plugin, versions earlier than 3.12.8, fails to sanitize or escape a layout builder setting before rendering it on a public endpoint. It also neglects to verify that the user creating or updating the setting has ownership rights. As a result, any user who holds the Contributor role or higher can embed arbitrary JavaScript into that setting. When a site visitor loads a page that displays the affected filter, the injected script executes in the visitor’s browser, enabling attackers to steal cookies, deface the site, or perform phishing attacks. This is a stored cross‑site scripting flaw that also includes a privilege escalation aspect, because the attacker does not need administrative rights to inject malicious code.

Any WordPress site running the YMC Filter plugin prior to release 3.12.8 is vulnerable. The vulnerability is specific to the layout builder feature of the plugin. There is no alternative version number or product name; it applies to the plugin as distributed in the WordPress repository. Site administrators should verify whether the plugin is installed and determine its version.

The severity of this flaw is high; attackers with Contributor or higher access can easily inject scripts, and the exploitation is straightforward because it requires only normal user interactions—no hacking of the server or highly privileged credentials. The EPSS score is not currently available, but the lack of an official KEV listing indicates that large‑scale exploitation has not yet been observed. Nevertheless, the combination of stored XSS and insufficient ownership checks makes the risk significant for any user with edit privileges on the site. To reduce exposure, sites should treat this as a priority issue and patch ASAP.