CVE-2024-9378: YML for Yandex Market XSS Vulnerability

CVE-2024-9378 Overview

CVE-2024-9378 is a Reflected Cross-Site Scripting (XSS) vulnerability in the YML for Yandex Market plugin for WordPress. The flaw affects all versions up to and including 4.7.2 and is tracked under [CWE-79]. It stems from insufficient input sanitization and output escaping of the page parameter within the plugin's settings page component. Unauthenticated attackers can inject arbitrary JavaScript into responses served by a vulnerable site. Successful exploitation requires user interaction, such as convincing an administrator or logged-in user to click a crafted link.

Critical Impact
Attackers can execute arbitrary JavaScript in the victim's browser session, enabling session theft, forced administrative actions, and site defacement when a privileged user follows a malicious link.

Affected Products

Icopydoc YML for Yandex Market plugin for WordPress, all versions through 4.7.2
WordPress installations with the plugin activated on the settings page path
Sites exposing class-y4ym-settings-page-feeds-wp-list-table.php to authenticated administrative sessions

Discovery Timeline

2024-10-02 - CVE-2024-9378 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-9378

Vulnerability Analysis

The vulnerability resides in the plugin's WP List Table implementation for the feeds settings page, specifically in classes/system/pages/settings-page/class-y4ym-settings-page-feeds-wp-list-table.php. The plugin reads the page request parameter and reflects its value into HTML output without applying WordPress sanitization functions such as esc_attr() or esc_url(). Because the parameter is embedded directly into attribute context, an attacker can break out of the attribute and inject a script payload.

Exploitation is unauthenticated but requires the victim to click a crafted URL. When the victim is a WordPress administrator, script execution occurs in the context of the admin session and can be used to create backdoor accounts, alter plugin settings, or exfiltrate nonces.

Root Cause

The root cause is missing output escaping on the reflected page query parameter. The code path returns user-controlled input to the browser without contextual encoding, violating the WordPress secure coding standard that requires esc_html(), esc_attr(), or esc_url() at the point of output. Vendor commit changeset 3160483 introduces the required escaping.

Attack Vector

The attack vector is network-based over HTTPS/HTTP against the WordPress admin interface. An attacker crafts a URL to the plugin's settings screen with a malicious page parameter containing script content. The attacker then delivers the link via phishing, forum posts, or social engineering. When a logged-in WordPress user visits the link, the injected script executes in their browser under the site's origin.

See the Wordfence Vulnerability Report and the vulnerable source line reference for technical details. No public proof-of-concept exploit is currently indexed.

Detection Methods for CVE-2024-9378

Indicators of Compromise

HTTP requests to wp-admin/admin.php containing suspicious characters (<, >, ", script) in the page query parameter targeting y4ym-prefixed pages.
Web server access logs showing referrers from external phishing domains preceding administrative actions.
Unexpected creation of WordPress administrator accounts or modifications to plugin options shortly after admin logins.

Detection Strategies

Deploy web application firewall (WAF) rules that inspect the page parameter for HTML control characters and known XSS payload patterns.
Monitor WordPress wp_users and wp_usermeta tables for out-of-band changes to administrator roles.
Correlate outbound browser telemetry from admin workstations with visits to plugin settings URLs that carry non-standard query strings.

Monitoring Recommendations

Enable audit logging plugins to record all administrative actions performed on the WordPress site, including plugin setting changes.
Alert on any HTTP 200 response from admin.php?page=y4ym* that returns a Content-Length significantly larger than baseline, indicating reflected payload injection.
Track EPSS scoring updates for CVE-2024-9378 to reassess urgency if exploitation activity increases.

How to Mitigate CVE-2024-9378

Immediate Actions Required

Update the YML for Yandex Market plugin to a version later than 4.7.2 that incorporates changeset 3160483.
Instruct WordPress administrators to avoid clicking on unsolicited links referencing the site's wp-admin interface.
Rotate WordPress administrator passwords and invalidate active sessions if the plugin was in use on an internet-exposed site.

Patch Information

The vendor addressed CVE-2024-9378 in the plugin repository via changeset 3160483, which applies proper escaping to the reflected page parameter in class-y4ym-settings-page-feeds-wp-list-table.php. WordPress site owners should upgrade through the plugin management console or by downloading the fixed release from the WordPress plugin directory.

Workarounds

Deactivate and remove the YML for Yandex Market plugin until it can be updated to a patched version.
Enforce a strict Content Security Policy (CSP) that disallows inline scripts on the WordPress admin path to blunt reflected payload execution.
Restrict access to wp-admin by source IP address using web server ACLs or a WAF, limiting the attack surface for reflected XSS against administrators.

bash

# Configuration example: nginx CSP header for wp-admin
location /wp-admin/ {
    add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self';" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;
}