RSS   Vulnerabilities for 'Youzify'   RSS

2021-08-02
 
CVE-2021-24443

CWE-79
 

 
The About Me widget of the Youzify ??�??�?? BuddyPress Community, User Profile, Social Network & Membership WordPress plugin before 1.0.7 does not properly sanitise its Biography field, allowing any authenticated user to set Cross-Site Scripting payloads in it, which will be executed when viewing the affected user profile. This could allow a low privilege user to gain unauthorised access to the admin side of the blog by targeting an admin, inducing them to view their profile with a malicious payload adding a rogue account for example.

 


Copyright 2024, cxsecurity.com

 

Back to Top