The YML for Yandex Market plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 4.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
History

Wed, 02 Oct 2024 18:30:00 +0000

Type Values Removed Values Added
First Time appeared Icopydoc
Icopydoc yml For Yandex Market
CPEs cpe:2.3:a:icopydoc:yml_for_yandex_market:*:*:*:*:*:wordpress:*:*
Vendors & Products Icopydoc
Icopydoc yml For Yandex Market
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}


Wed, 02 Oct 2024 08:45:00 +0000

Type Values Removed Values Added
Description The YML for Yandex Market plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'page' parameter in all versions up to, and including, 4.7.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.
Title YML for Yandex Market <= 4.7.2 - Reflected Cross-Site Scripting
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}


cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published: 2024-10-02T08:31:50.499Z

Updated: 2024-10-02T17:38:34.333Z

Reserved: 2024-09-30T21:02:20.882Z

Link: CVE-2024-9378

cve-icon Vulnrichment

Updated: 2024-10-02T17:38:27.191Z

cve-icon NVD

Status : Analyzed

Published: 2024-10-02T09:15:04.257

Modified: 2024-10-07T20:15:08.697

Link: CVE-2024-9378

cve-icon Redhat

No data.