CVE-2026-39780
HighCVSS 7.1Summary
The Youzify plugin in versions up to 1.3.7 contains a Cross Site Scripting (XSS) vulnerability. The vulnerability can be exploited by an unauthenticated attacker.
Risk Assessment
An attacker can inject malicious script that executes in the user's browser, potentially leading to session or data theft. The risk affects all installations of the plugin version 1.3.7 and earlier.
Recommendation
Update the Youzify plugin to the latest version that does not contain the vulnerability. If updating is not possible, consider disabling the plugin until it is fixed.
Other vulnerabilities in Youzify
See all- CVE-2026-73397Critical
Unauthenticated Deserialization of untrusted data vulnerability in Youzify plugin versions up to 1.3.7. An attacker without authentication can deserialize data, potentially leading to remote code execution.
- CVE-2026-81275Medium
The Youzify plugin in versions up to and including 1.3.7 allows a Subscriber-level user to download arbitrary files. Insufficient path validation enables access to files outside the intended scope.
Original NVD description (English source)
Unauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS