What is GHSA-qgw2-v7vq-9g5r?

GHSA-qgw2-v7vq-9g5r is a security advisory published by GitHub Security Advisories with Medium severity. The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of...

Which CVE IDs does GHSA-qgw2-v7vq-9g5r cover?

GHSA-qgw2-v7vq-9g5r covers the following CVE IDs: CVE-2026-16559. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qgw2-v7vq-9g5r?

GHSA-qgw2-v7vq-9g5r has a CVSS v3 base score of 6.8, published by GitHub Security Advisories.

GHSA-qgw2-v7vq-9g5rMediumCVSS 6.8

The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of...

Vendor

GitHub Security Advisories

Published

August 8, 2026

Last Modified

August 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-16559 →

📋 Description

The YMC Filter WordPress plugin before 3.12.9 does not sanitize SVG files uploaded through one of its icon upload features and permits their upload by low-privileged users, allowing users with the Author role and above to upload a file containing JavaScript that executes in the site's origin when the file is viewed.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-16559
https://wpscan.com/vulnerability/9b8d265a-542f-4e1b-966d-3fc3dbf7a800
https://github.com/advisories/GHSA-qgw2-v7vq-9g5r