Youzify < 1.2.0 - Unauthenticated SQLi

The Youzify WordPress plugin before 1.2.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to an unauthenticated SQL injection id: CVE-2022-1950 info: name: Youzify 1.2.0 - Unauthenticated SQLi author:...

CVE-2026-81275

Subscriber Arbitrary File Download in Youzify = 1.3.7 versions...

CVE-2026-81275 WordPress Youzify plugin <= 1.3.7 - Arbitrary File Download vulnerability

Subscriber Arbitrary File Download in Youzify = 1.3.7 versions...

CVE-2026-81275 WordPress Youzify plugin <= 1.3.7 - Arbitrary File Download vulnerability

Subscriber Arbitrary File Download in Youzify = 1.3.7 versions...

CVE-2026-81275

The WordPress Youzify plugin (versions

EUVD-2026-75514

Subscriber Arbitrary File Download in Youzify = 1.3.7 versions...

CVE-2026-81275: Improper Limitation of a Pathname to a Restricted Directory

Subscriber Arbitrary File Download in Youzify = 1.3.7 versions...

PT-2026-89428

Subscriber Arbitrary File Download in Youzify = 1.3.7 versions...

WordPress Youzify plugin <= 1.3.7 - Arbitrary File Download vulnerability

Arbitrary File Download vulnerability discovered by dodoh4t in WordPress Plugin Youzify versions = 1.3.7...

CVE-2026-73397

Unauthenticated Deserialization of untrusted data in Youzify = 1.3.7 versions...

CVE-2026-73397 WordPress Youzify plugin <= 1.3.7 - Deserialization of untrusted data vulnerability

Unauthenticated Deserialization of untrusted data in Youzify = 1.3.7 versions...

CVE-2026-73397 WordPress Youzify plugin <= 1.3.7 - Deserialization of untrusted data vulnerability

Unauthenticated Deserialization of untrusted data in Youzify = 1.3.7 versions...

CVE-2026-73397

Unauthenticated Deserialization of untrusted data in Youzify = 1.3.7 versions...

EUVD-2026-60803

Unauthenticated Deserialization of untrusted data in Youzify = 1.3.7 versions...

CVE-2026-73397

Youzify plugin versions up to 1.3.7 suffer from unauthenticated deserialization of untrusted data, scored CVSS 9.8 (critical) with network access, no privileges, and full CIA impact. Upgrade beyond 1.3.7 or disable the plugin; no exploit code is provided in the documents.

WordPress Youzify plugin <= 1.3.7 - Deserialization of untrusted data vulnerability

Deserialization of untrusted data vulnerability discovered by Peter Thaleikis in WordPress Plugin Youzify versions = 1.3.7...

CVE-2026-73397: Deserialization of Untrusted Data

Unauthenticated Deserialization of untrusted data in Youzify = 1.3.7 versions...

PT-2026-77117

Name of the Vulnerable Software and Affected Versions Youzify versions prior to 1.3.8 Description The software contains an unauthenticated deserialization flaw. This issue allows an attacker to process untrusted data without requiring authentication or user interaction, making it exploitable over...

CVE-2026-1559

The Youzify plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'checkinplaceid' parameter in all versions up to, and including, 1.3.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access...

WordPress Youzify plugin <= 1.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting via 'checkin_place_id' Parameter vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting via 'checkinplaceid' Parameter vulnerability discovered by Tharadol Suksamran d3kc4rt1 in WordPress Plugin Youzify versions = 1.3.6...