Description
Unauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7 versions.
Published: 2026-10-06
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Cross Site Scripting
Action: Immediate Patch
AI Analysis

Impact

An unauthenticated Cross Site Scripting (XSS) vulnerability exists in the Youzify WordPress plugin versions 1.3.7 and earlier. The flaw allows malicious scripts to be injected via user input and rendered within pages that other visitors load. The weakness is an input validation issue classified as CWE‑79.

Affected Systems

The vulnerability affects the Youzify plugin distributed for WordPress. All releases up to and including 1.3.7 are affected. Users running this plugin on any WordPress installation are potentially exposed. No specific version beyond 1.3.7 is listed as vulnerable.

Risk and Exploitability

The CVSS score of 7.1 indicates high severity. The EPSS score is 0.00191 (0.191%), indicating a very low but non‑zero probability of exploitation. The vulnerability is publicly known but not listed in CISA KEV. The flaw is unauthenticated, meaning an attacker does not need to log in to exploit it. The specific attack vector is not detailed in the CVE description; it is inferred that it could involve any input mechanism provided by the plugin that fails to sanitize data. No further exploitation conditions are stated.

Generated by OpenCVE AI on October 7, 2026 at 05:44 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Youzify plugin to the latest version (1.3.8 or newer) that removes the vulnerable input handling.
  • If an immediate upgrade is not feasible, disable the plugin or restrict its access to trusted users only, limiting the impact of potential XSS payloads.
  • Configure the WordPress site to enforce a strict Content Security Policy that disallows inline scripts and restricts script sources, reducing the damage of any injected code.

Generated by OpenCVE AI on October 7, 2026 at 05:44 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Oct 2026 22:00:00 +0000

Type Values Removed Values Added
First Time appeared Wordpress-extensions
Wordpress-extensions youzify
Youzify
Youzify youzify
Vendors & Products Wordpress-extensions
Wordpress-extensions youzify
Youzify
Youzify youzify

Tue, 06 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Description Unauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7 versions.
Title WordPress Youzify plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

Wordpress-extensions Youzify
Youzify Youzify
cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-06T10:31:34.839Z

Reserved: 2026-04-07T10:59:10.176Z

Link: CVE-2026-39780

cve-icon Vulnrichment

Updated: 2026-10-06T10:29:36.007Z

cve-icon NVD

Status : Deferred

Published: 2026-10-06T09:17:50.647

Modified: 2026-10-06T15:04:25.990

Link: CVE-2026-39780

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T05:45:13Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')