YML for Yandex Market

YML for Yandex Market has 5 disclosed vulnerabilities in the WordSec catalog, reported between 2023 and 2026; all 5 are fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 7.2 out of 10. Severity breakdown: 0 critical and 1 high. 2026 was the busiest year with 2 disclosures.

The most common weakness is Cross-Site Scripting, behind 3 of the records (60%). Other recurring categories include Code Injection, Path Traversal.

Every one of the 5 issues recorded for YML for Yandex Market has a vendor fix available, so running the current release closes all known holes.

5 independent researchers contributed these findings, one record each. YML for Yandex Market is installed on roughly 10,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.

Strategic Overview

Avg CVSSMedium

6.4/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all YML for Yandex Market vulnerabilities before they are exploited.

Highest severity on recordCVSS 7.2CVE-2025-14545

YML for Yandex Market < 5.0.26 - Authenticated (Shop Manager+) Remote Code Execution

Read the full analysis

Vulnerability Records

5 records


2026-03-23 00:00	YML for Yandex Market < 5.3.0 - Authenticated (Shop Manager+) Arbitrary File Deletion YML for Yandex Market < 5.3.0	`CVE-2026-32567`	6.5 Medium	Nguyen Ba Khanh	Yes
2026-03-19 00:00	YML for Yandex Market < 5.0.26 - Authenticated (Shop Manager+) Remote Code Execution YML for Yandex Market < 5.0.26	`CVE-2025-14545`	7.2 High	Alex Tselevich (nos3curity)	Yes
2024-10-01 00:00	YML for Yandex Market <= 4.7.2 - Reflected Cross-Site Scripting YML for Yandex Market <= 4.7.2	`CVE-2024-9378`	6.1 Medium	Colin Xu	Yes
2024-02-23 00:00	YML for Yandex Market <= 4.2.3 - Reflected Cross-Site Scripting YML for Yandex Market <= 4.2.3	`CVE-2024-1365`	6.1 Medium	Krzysztof Zając	Yes
2023-04-17 00:00	Yml for Yandex Market <= 3.10.7 - Reflected Cross-Site Scripting YML for Yandex Market < 3.10.8	`CVE-2023-30473`	6.1 Medium	LEE SE HYOUNG	Yes

Showing 1–5 of 5 reports

Latestv5.8.1

YML for Yandex Market

Author

icopydoc

4.8(72)

96/100

Last Updated

2026-09-08 (5d ago)

Active Installs

10,000+

Downloads

729,415

Requires WP

5.9+

Requires PHP

7.4.0+

Tested up to

WP 7.1

Created

2017-05-18 (10y ago)

Requires Plugins

woocommerce

Creates a YML-feed to upload to Yandex Market and not only. Purpose of the plugin Creates a YML-feed to upload to Yandex Market and not only. In addition to Yandex Market, the plugin is also used for: СберМегаМаркет Yandex Turbo-pages Yandex delivery GOODS.ru boo.ua 2gis.com AliExpress.com Маркетплейс Маркета (BERU) Портал поставщиков Москвы Точка банк CDEK (partial support) OZON (partial support) ВКонтакте (vk.com) (partial support) EBay (partial support) Flowwow (flowwow.com) (partial support) Youla (youla.ru) (partial support) and not only… The plugin Woocommerce is required! PRO version: https://icopydoc.ru/product/yml-for-yandex-market-pro/ *If there is an appropriate supplement. See Extensions page. Format and method requirements for product data feeds For a better understanding of the principles of YML feed – read this: https://yandex.ru/support/market-tech-requirements/index.html

View on WordPress.org