Vulnerabilities and security researches forymc-smart-filter ymc-smart-filter

Jul 03, 2024

CVE, Research URL: CVE-2024-6164
Home page URL: Security reports for Filter & Grids
Application: Filter & Grids
Date: Jul 18, 2024
Research Description: The Filter & Grids WordPress plugin before 2.8.33 is vulnerable to Local File Inclusion via the post_layout parameter. This makes it possible for an unauthenticated attacker to include and execute PHP files on the server, allowing the execution of any PHP code in those files.
Affected versions: max 2.8.33.
Status: vulnerable

Aug 03, 2024

CVE, Research URL: CVE-2024-39665
Home page URL: Security reports for Filter & Grids
Application: Filter & Grids
Date: Aug 02, 2024
Research Description: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in YMC Filter & Grids allows Stored XSS.This issue affects Filter & Grids: from n/a through 2.9.2.
Affected versions: max 2.9.3.
Status: vulnerable

Aug 05, 2024

CVE, Research URL: CVE-2024-39664
Home page URL: Security reports for Filter & Grids
Application: Filter & Grids
Date: Nov 01, 2024
Research Description: Missing Authorization vulnerability in YMC Filter & Grids allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Filter & Grids: from n/a through 2.8.33.
Affected versions: max 2.8.34.
Status: vulnerable

Jan 09, 2026

CVE, Research URL: CVE-2025-10289
Home page URL: Security reports for Filter & Grids
Application: Filter & Grids
Date: Dec 13, 2025
Research Description: The Filter & Grids plugin for WordPress is vulnerable to SQL Injection via the 'phrase' parameter in all versions up to, and including, 3.2.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This only works on MariaDB as the query results in a syntax error on MySQL.
Affected versions: max 3.2.1.
Status: vulnerable