CVSS
6.8
CVSS v3.1
EPSS
0.2%
Exploit Prediction Score
Published
August 8, 2026
Exploitability
EPSS probability 0.2%
The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users, allowing users with the Author role and above to upload a file containing JavaScript that executes in the site's origin when the file is viewed.
No package data available.
Publisher and database URLs for this record (shown for attribution; reading stays in Bugflare).