https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 10 Nov 2026 04:26:27 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-120548 <p>The YML for Yandex Market plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.10.0 via the &#39;y4ym_check_action&#39; parameter. This makes it possible for unauthenticated attackers to extract the merchant&#39;s plaintext Yandex Market API key written to the publicly accessible log file at wp-content/uploads/y4ym/yml-for-yandex-market.log, granting full control over the merchant&#39;s marketplace catalogue, prices, and stock. Exploitation requires that the targeted feed has a stored Yandex Market API key and that the y4ym_keeplogs option is enabled — both conditions that represent normal, documented plugin usage actively encouraged by the plugin&#39;s own support and feedback workflow.</p> <p>The YML for Yandex Market plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.10.0 via the &#39;y4ym_check_action&#39; parameter. This makes it possible for unauthenticated attackers to extract the merchant&#39;s plaintext Yandex Market API key written to the publicly accessible log file at wp-content/uploads/y4ym/yml-for-yandex-market.log, granting full control over the merchant&#39;s marketplace catalogue, prices, and stock. Exploitation requires that the targeted feed has a stored Yandex Market API key and that the y4ym_keeplogs option is enabled — both conditions that represent normal, documented plugin usage actively encouraged by the plugin&#39;s own support and feedback workflow.</p> https://db.gcve.eu/vuln/fkie_cve-2026-120548 https://db.gcve.eu/vuln/ghsa-qmj7-j3cv-2hjp <p>The YML for Yandex Market plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.10.0 via the &#39;y4ym_check_action&#39; parameter. This makes it possible for unauthenticated attackers to extract the merchant&#39;s plaintext Yandex Market API key written to the publicly accessible log file at wp-content/uploads/y4ym/yml-for-yandex-market.log, granting full control over the merchant&#39;s marketplace catalogue, prices, and stock. Exploitation requires that the targeted feed has a stored Yandex Market API key and that the y4ym_keeplogs option is enabled — both conditions that represent normal, documented plugin usage actively encouraged by the plugin&#39;s own support and feedback workflow.</p> <p>The YML for Yandex Market plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.10.0 via the &#39;y4ym_check_action&#39; parameter. This makes it possible for unauthenticated attackers to extract the merchant&#39;s plaintext Yandex Market API key written to the publicly accessible log file at wp-content/uploads/y4ym/yml-for-yandex-market.log, granting full control over the merchant&#39;s marketplace catalogue, prices, and stock. Exploitation requires that the targeted feed has a stored Yandex Market API key and that the y4ym_keeplogs option is enabled — both conditions that represent normal, documented plugin usage actively encouraged by the plugin&#39;s own support and feedback workflow.</p> https://db.gcve.eu/vuln/ghsa-qmj7-j3cv-2hjp