WordPress security by component

Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for

Plugin description

Youzify adds BuddyPress community features including user profiles, social activity, groups, memberships, and member interactions.

Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for (youzify) is a WordPress plugin with 17 published CVE records in this archive. The latest tracked vulnerability was published Oct 06, 2026; the highest published CVSS base score is 9.8.

Plugin slug: youzify

Latest vulnerability

CVE-2026-39780: Youzify: cross-site scripting

No attacker login is required. Attacker-controlled content is rendered in browser output without sufficient neutralization, allowing script execution under the site's origin when a victim encounters the affected output. The endpoint, field, rendering function and victim role are undisclosed. The export does not distinguish stored from reflected XSS. The supplied vector reports limited confidentiality impact, limited integrity impact, limited availability impact. Victim interaction is required by the vector. Affected versions: <= 1.3.7. No fixed release is confirmed. The checked official release is 1.3.7; it does not establish a fixed version for this CVE.

PublishedOct 06, 2026

Safe version guidanceSee mitigation notes

Published vulnerabilities for youzify
		Safe version
Oct 06, 2026	CVE-2026-39780 Youzify: cross-site scripting No attacker login is required. Attacker-controlled content is rendered in browser output without sufficient neutralization, allowing script execution under the site's origin when a victim encounters the affected output. The endpoint, field, rendering function and victim role are undisclosed. The export does not distinguish stored from reflected XSS. The supplied vector reports limited confidentiality impact, limited integrity impact, limited availability impact. Victim interaction is required by the vector. Affected versions: <= 1.3.7. No fixed release is confirmed. The checked official release is 1.3.7; it does not establish a fixed version for this CVE.	See mitigation notes	CVE7.1 NVDPending
Sep 10, 2026	CVE-2026-81275 Youzify permits subscriber-level arbitrary file downloads Youzify through 1.3.7 permits arbitrary file downloads by an authenticated Subscriber. The CNA identifies a path-traversal weakness and rates confidentiality impact as high, with no user interaction required. The record establishes file disclosure, not file modification.	See mitigation notes	CVE6.5 NVDPending
Aug 18, 2026	CVE-2026-73397 Youzify: Code execution Youzify is affected by code execution. The vulnerable path is reachable without authentication. Successful exploitation can run attacker-controlled code in the WordPress hosting account. The published affected range is n/a through 1.3.7.	See mitigation notes	CVE9.8 NVDPending
Apr 18, 2026	CVE-2026-1559 Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress: Cross-site scripting Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress is affected by cross-site scripting. Exploitation requires an authenticated subscriber account. Injected script can execute in the affected site's origin when the vulnerable output is viewed. The published affected range is <= 1.3.6.	See mitigation notes	CVE6.4 NVDPending
Dec 30, 2025	CVE-2025-69014 Youzify: Server-side request forgery Youzify is affected by server-side request forgery. Exposure depends on how the affected operation is made reachable by the site. The vulnerable server can be induced to make attacker-selected network requests.	See mitigation notes	CVE4.9 NVDPending
Jan 25, 2025	CVE-2024-13370 Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for: A security weakness Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE6.5 NVDPending
Jan 25, 2025	CVE-2024-13368 Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for: A security weakness Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3 NVDPending
Jan 25, 2025	CVE-2024-12113 Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for: A security weakness Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3 NVDPending
Nov 01, 2024	CVE-2024-39635 Youzify: A security weakness Youzify is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE5.4 NVD8.8
Oct 10, 2024	CVE-2024-9067 Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for: A security weakness Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for is affected by a security weakness. Exploitation requires an authenticated subscriber account. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE4.3 NVDPending
Oct 10, 2024	CVE-2024-8987 Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for: Cross-site scripting Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for is affected by cross-site scripting. Exploitation requires an authenticated contributor account. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE6.4 NVD5.4
Jul 09, 2024	CVE-2024-37494 Youzify: SQL injection Youzify is affected by SQL injection. Exposure depends on how the affected operation is made reachable by the site. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE8.5 NVD8.8
Jun 20, 2024	CVE-2024-4742 Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for: SQL injection Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for is affected by SQL injection. Exploitation requires an authenticated contributor account. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVE6.5 NVD8.8
Dec 21, 2023	CVE-2023-47191 Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress: A security weakness Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.	See mitigation notes	CVE6.5 NVD6.5
Feb 21, 2023	CVE-2023-0059 Youzify: Cross-site scripting Youzify is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVE5.4 NVD5.4
Aug 01, 2022	CVE-2022-1950 Youzify: SQL injection Youzify is affected by SQL injection. The vulnerable path is reachable without authentication. A successful request can alter database queries and expose or modify WordPress data.	See mitigation notes	CVEPending NVD9.8
Aug 02, 2021	CVE-2021-24443 About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership: Cross-site scripting About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership is affected by cross-site scripting. Exposure depends on how the affected operation is made reachable by the site. Injected script can execute in the affected site's origin when the vulnerable output is viewed.	See mitigation notes	CVEPending NVD5.4

Data attribution: This product uses the NVD API but is not endorsed or certified by the NVD.

Vulnerability data licensing

CVE. Copyright © 1999–2026, The MITRE Corporation. MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.

CWE. Copyright © 2006–2026, The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy.

CVSS. CVSS is owned and managed by FIRST.Org, Inc. (FIRST) and used by permission.

Source-record text is CVE/CNA content delivered through the NVD API. Fused summaries and remediation guidance are independently authored and are not attributed to NVD.

All other copyrights and trademarks are the property of their respective owners.

Full data sources, terms, and disclaimers