CVE-2021-24443
Medium
Description
The About Me widget of the Youzify – BuddyPress Community, User Profile, Social Network & Membership WordPress plugin before 1.0.7 does not properly sanitise its Biography field, allowing any authenticated user to set Cross-Site Scripting payloads in it, which will be executed when viewing the affected user profile. This could allow a low privilege user to gain unauthorised access to the admin side of the blog by targeting an admin, inducing them to view their profile with a malicious payload adding a rogue account for example.
SeverityMedium
CVSS5.4
Exploit probability—
ProductKainelabs Youzify
PublishedAug 2, 2021
First seenAug 2, 2021
Weakness typeCWE-79Cross-site scripting (XSS)
How to fix
Update
- kainelabs youzify1.0.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| kainelabs youzify | v < 1.0.7 | 1.0.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.