The YML for Yandex Market plugin for WordPress suffers from a reflected XSS vulnerability via the feed_id parameter. This occurs because the plugin does not properly sanitize or escape input before including it in web pages. An attacker can exploit this by crafting a URL containing malicious script code in the feed_id parameter, which executes in the context of the victim's browser when they visit the URL. The vulnerability affects all versions up to 4.2.3. There is no indication of known exploits in the wild or an official patch at this time.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of a victim's browser, potentially leading to information disclosure or session hijacking. The impact is limited to confidentiality and integrity with no direct availability impact. The vulnerability requires user interaction (clicking a malicious link) and network access to the vulnerable plugin instance.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid clicking suspicious links that reference the vulnerable feed_id parameter. Monitoring official icopydoc or WordPress plugin channels for updates is recommended.