CVE-2026-16559 is a stored XSS vulnerability in YMC Filter's SVG icon upload feature. An Author-level user can upload a crafted SVG containing JavaScript that executes when any user views a page rendering that icon—no administrator interaction or follow-up clicks required. The CVSS 6.8 score dramatically undersells the actual risk in typical WordPress deployments.
The vulnerability works because SVG files are executable XML, not images, but WordPress's media handling APIs treat them as standard image uploads with no sanitization enforcement. WordPress core doesn't provide SVG sanitization as a built-in capability, which means every plugin author must independently discover and implement proper handling—a requirement most non-security-focused developers never encounter until a CVE lands.
What matters more than the plugin-specific failure: the blast radius model. The malicious SVG enters WordPress's shared media library and becomes available site-wide. It renders in admin dashboard views, embeds in post content, and executes in the context of every visitor who encounters the page. That's a 1:many amplification that CVSS's per-session impact scoring doesn't capture. On a ten-author publication site, one compromised Author account uploads a malicious SVG, and suddenly every administrator, editor, and reader viewing any page with that icon has session context at risk—passively, on view, without returning to the site.
The temporal dimension is worse. The SVG file doesn't become harmless when the vendor patches. It persists in media libraries, backups, site migrations, and CDN caches indefinitely unless someone actively purges it. The exposure window for each artifact remains open far longer than the CVE-to-patch window.
Practical defense: audit your media library for SVG uploads you didn't explicitly whitelist, regardless of which plugin uploaded them. Treat any pre-patch SVG from a plugin with upload capability as potentially malicious. Consider implementing SVG sanitization at the WordPress theme or mu-plugin level as a safety net—if WordPress core won't enforce it, your own codebase can catch what individual plugins miss. The systemic fix (core-provided SVG sanitization) would truncate future incidents, but it won't clean up the exposure tail already embedded in deployed sites.