CVE-2024-9067 Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.0 - Missing Authorization to Arbitrary (Subscriber+) Attachment Deletion

The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'deleteattachment' function in all versions up to, and including, 1.3.0. This makes i...

CVE-2024-9067

The CVE-2024-9067 entry concerns Youzify for WordPress. A missing capability check in the delete_attachment function across versions up to 1.3.0 allows authenticated users with Subscriber+ privileges to modify data by deleting arbitrary attachments. This is a Broken Access Control issue in Youzif...

CVE-2024-8987

CVE-2024-8987 (Youzify) is a stored XSS vulnerability in the Youzify – BuddyPress WordPress plugin (versions up to and including 1.3.0) that allows authenticated attackers with contributor-level access and above to inject script via the youzify_media shortcode. The issue stems from insufficient i...

CVE-2024-8987 Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via youzify_media Shortcode

The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's youzifymedia shortcode in all versions up to, and including, 1.3.0 due to insufficient input sanitization and outpu...

CVE-2024-8987 Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via youzify_media Shortcode

The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's youzifymedia shortcode in all versions up to, and including, 1.3.0 due to insufficient input sanitization and outpu...

WordPress plugin Youzify 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress plugin Youzify 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

WordPress Youzify plugin <= 1.3.0 - Missing Authorization to Arbitrary (Subscriber+) Attachment Deletion vulnerability

Missing Authorization to Arbitrary Subscriber+ Attachment Deletion vulnerability discovered by Francesco Carlucci in WordPress Plugin Youzify versions = 1.3.0...

WordPress Youzify plugin <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Peter Thaleikis in WordPress Plugin Youzify versions = 1.3.0...

PT-2024-39402 · WordPress · Youzify

Name of the Vulnerable Software and Affected Versions: The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress versions up to, and including, 1.3.0 Description: The issue allows authenticated attackers with Subscriber-level access and above to delete...

WordPress Youzify Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Software Youzify Type Plugin Vulnerable versions = 1.3.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8987 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID e02642daa02f Credits Peter Thaleikis Required privilege...

WordPress Youzify Plugin <= 1.3.0 is vulnerable to Broken Access Control

Software Youzify Type Plugin Vulnerable versions = 1.3.0 Fixed in 1.3.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-9067 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID d8d6ded5ddf5 Credits Francesco Carlucci Required privilege...

PT-2024-39353 · WordPress · Youzify

Name of the Vulnerable Software and Affected Versions: Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress versions up to, and including, 1.3.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's youzify media shortcode due ...

WordPress Youzify plugin <= 1.2.6 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by LVT-tholv2k Patchstack Alliance in WordPress Plugin Youzify versions = 1.2.6...

WordPress Youzify Plugin <= 1.2.6 is vulnerable to Broken Access Control

Software Youzify Type Plugin Vulnerable versions = 1.2.6 Fixed in 1.2.8 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-39635 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID b77bf27da026 Credits LVT-tholv2k Required privilege...

CVE-2024-37494

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in KaineLabs Youzify.This issue affects Youzify: from n/a through 1.2.5...

CVE-2024-37494

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in KaineLabs Youzify.This issue affects Youzify: from n/a through 1.2.5...

CVE-2024-37494 WordPress Youzify plugin <= 1.2.5 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in KaineLabs Youzify.This issue affects Youzify: from n/a through 1.2.5...

CVE-2024-37494 WordPress Youzify plugin <= 1.2.5 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in KaineLabs Youzify.This issue affects Youzify: from n/a through 1.2.5...

CVE-2024-37494

Technical details about CVE-2024-37494 (Youzify) are not provided in the connected documents. Please monitor for updates from official advisories for affected products and versions.