Youzify BuddyPress Plugin Vulnerable to Stored Cross-Site Scripting
CVE-2024-8987
5.4MEDIUM
Key Information:
- Vendor
- Youzify
- Status
- Youzify – Buddypress Community, User Profile, Social Network & Membership Plugin For WordPress
- Vendor
- CVE Published:
- 10 October 2024
Summary
The Youzify plugin, which enhances BuddyPress for WordPress sites, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability that arises from improper input sanitization and output escaping in the youzify_media shortcode. This issue affects all versions up to and including 1.3.0. Authenticated users with contributor-level access or higher can exploit this flaw, allowing them to inject malicious web scripts into pages. These scripts will execute whenever an unsuspecting user accesses the compromised pages, potentially leading to unauthorized actions and data theft.
Affected Version(s)
Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress * <= 1.3.0
References
CVSS V3.1
Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Peter Thaleikis