The vulnerability arises from insufficient input sanitization and output escaping when the checkin_place_id parameter is processed. Allowing authenticated attackers with Subscriber or higher privileges to embed arbitrary JavaScript results in stored XSS that executes whenever any user views the affected page. This can lead to session hijacking, credential theft, malicious redirects, or defacement of content, compromising the confidentiality and integrity of users’ sessions.

WordPress sites running the Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress. Versions up to and including 1.3.6 are affected. Any user who has Subscriber‑level access or higher on the WordPress installation can exploit the flaw.

The defect has a CVSS score of 6.4, indicating a moderate severity. The EPSS score for this vulnerability is not available, and it is not listed in the CISA KEV catalog. Exploitation requires an authenticated account with Subscriber privileges, making the attack vector internal to the host site. An attacker can inject malicious scripts that are then executed for every user who visits the page, providing a high-impact vector for credential theft or session hijacking. While the need for an authenticated role limits broader exposure, the impact on user accounts warrants prompt remediation.