EUVD-2026-93028
GHSA-pj74-q755-f5v8
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Unauthenticated reflected XSS reachable over the network (AV:N/AC:L/PR:N) requires victim interaction (UI:R) and crosses into the browser context (S:C) with limited C/I/A impact.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7 versions.
AnalysisAI
Reflected cross-site scripting in the Youzify WordPress plugin (versions through 1.3.7) lets unauthenticated attackers execute arbitrary JavaScript in the browser of any user who is lured into following a crafted link, carrying a CVSS 3.1 base score of 7.1. No authentication is required of the attacker (PR:N), but successful exploitation depends on victim interaction with an attacker-supplied URL (UI:R), and the script executes with changed scope (S:C) producing low confidentiality, integrity, and availability impact confined to the victim's browser session rather than the server. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an attacker to deliver a crafted request/link and have a victim user interact with it (UI:R in the CVSS vector) - the payload is reflected, so there is no persistence and each exploitation depends on social engineering a target into clicking an attacker-supplied URL. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a reflected, unauthenticated Cross-Site Scripting flaw (CWE-79) in the Youzify WordPress plugin at versions <= 1.3.7, carrying a CVSS 3.1 base score of 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch version is identified in the available data, so the first step is to check the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/youzify/vulnerability/wordpress-youzify-plugin-1-3-7-cross-site-scripting-xss-vulnerability?_s_id=cve) and the plugin's WordPress.org page for an updated release covering versions above 1.3.7, then upgrade immediately once an exact fixed version is published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm whether your organization uses the Youzify plugin on any WordPress sites and, if so, identify all instances running versions through 1.3.7; if the plugin is not business-critical, temporarily disable or remove it. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The Youzify WordPress plugin before 1.2.0 does not sanitise and escape a parameter before using it in a SQL statement vi
Insecure deserialization in the Youzify WordPress plugin (versions 1.3.7 and earlier) allows remote unauthenticated atta
The Youzify WordPress plugin before 1.2.2 does not validate and escape some of its shortcode attributes before outputtin
The About Me widget of the Youzify - BuddyPress Community, User Profile, Social Network & Membership WordPress plugin be
Missing Authorization vulnerability in KaineLabs Youzify allows Exploiting Incorrectly Configured Access Control Securit
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in KaineLabs Youzify.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KaineLabs Youzify
The Youzify - BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress
Path traversal in the Youzify WordPress plugin (versions ≤ 1.3.7) allows any authenticated subscriber to download arbitr
The Youzify - BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress
Authorization Bypass Through User-Controlled Key vulnerability in KaineLabs Youzify - BuddyPress Community, User Profile
The Youzify - BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today