CVE-2026-16559EPSS p4.9%

CVE-2026-16559CVE-2026-16559

Description

The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users, allowing users with the Author role and above to upload a file containing JavaScript that executes in the site's origin when the file is viewed.

Scoring

CVSS 6.8 ()
VectorCVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
EPSS0.15% probability of exploitation · percentile 4.9% · 2026-08-11T12:00:17Z
Last modified2026-08-11
Sourced from NVD + FIRST.org EPSS. Curated for EU compliance use cases by Adam Lundqvist, Founder at SQUR.