Youzify BuddyPress Plugin Vulnerable to Stored Cross-Site Scripting

CVE-2024-8987

What is CVE-2024-8987?

The Youzify plugin, which enhances BuddyPress for WordPress sites, is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability that arises from improper input sanitization and output escaping in the youzify_media shortcode. This issue affects all versions up to and including 1.3.0. Authenticated users with contributor-level access or higher can exploit this flaw, allowing them to inject malicious web scripts into pages. These scripts will execute whenever an unsuspecting user accesses the compromised pages, potentially leading to unauthorized actions and data theft.

References