CVE-2024-9378
CVSS 3.1 Score 6.1 of 10 (medium)
Details
Published Oct 2, 2024
Updated: Oct 7, 2024
CWE ID 79
Summary
CVE-2024-9378 is a Reflected Cross-Site Scripting (XSS) vulnerability affecting the YML for Yandex Market plugin for WordPress. The issue lies in the insufficient sanitization and output escaping of the 'page' parameter, allowing unauthenticated attackers to inject malicious web scripts. Successful exploitation requires tricking a user into taking an action, such as clicking on a link. All versions up to and including 4.7.2 are impacted.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.