https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 10 Nov 2026 04:04:15 +0000 https://db.gcve.eu/vuln/cve-2026-120548 <p><strong>Affected:</strong> icopydoc YML for Yandex Market</p> <p>The YML for Yandex Market plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.10.0 via the &#39;y4ym_check_action&#39; parameter. This makes it possible for unauthenticated attackers to extract the merchant&#39;s plaintext Yandex Market API key written to the publicly accessible log file at wp-content/uploads/y4ym/yml-for-yandex-market.log, granting full control over the merchant&#39;s marketplace catalogue, prices, and stock. Exploitation requires that the targeted feed has a stored Yandex Market API key and that the y4ym_keeplogs option is enabled — both conditions that represent normal, documented plugin usage actively encouraged by the plugin&#39;s own support and feedback workflow.</p> <p><strong>Affected:</strong> icopydoc YML for Yandex Market</p> <p>The YML for Yandex Market plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.10.0 via the &#39;y4ym_check_action&#39; parameter. This makes it possible for unauthenticated attackers to extract the merchant&#39;s plaintext Yandex Market API key written to the publicly accessible log file at wp-content/uploads/y4ym/yml-for-yandex-market.log, granting full control over the merchant&#39;s marketplace catalogue, prices, and stock. Exploitation requires that the targeted feed has a stored Yandex Market API key and that the y4ym_keeplogs option is enabled — both conditions that represent normal, documented plugin usage actively encouraged by the plugin&#39;s own support and feedback workflow.</p> https://db.gcve.eu/vuln/cve-2026-120548