PT-2026-69172

Name of the Vulnerable Software and Affected Versions YMC Filter versions prior to 3.12.8 Description The plugin fails to sanitize and escape a layout builder setting before it is output on a public endpoint. Additionally, the software does not verify object ownership when the setting is saved...

CVE-2026-16558: Improper Neutralization of Input During Web Page Generation

The YMC Filter WordPress plugin before 3.12.8 does not sanitize and escape a layout builder setting before outputting it on a public endpoint, and does not verify object ownership when the setting is saved, allowing users with the Contributor role and above to store JavaScript that executes in th...