Youzify vulnerabilities

The Youzify plugin in versions up to 1.3.7 contains a Cross Site Scripting (XSS) vulnerability. The vulnerability can be exploited by an unauthenticated attacker.

Unauthenticated Deserialization of untrusted data vulnerability in Youzify plugin versions up to 1.3.7. An attacker without authentication can deserialize data, potentially leading to remote code execution.

The Youzify plugin in versions up to and including 1.3.7 allows a Subscriber-level user to download arbitrary files. Insufficient path validation enables access to files outside the intended scope.