Security Alert Summary
The Youzify plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the checkin_place_id parameter. Authenticated users with Subscriber-level access and above can inject scripts that will execute when other users view the affected pages due to insufficient input sanitization and output escaping.
CVE Details
- CVE ID: CVE-2026-1559
- Affected component: Youzify plugin for WordPress
- Affected versions: All versions up to and including 1.3.6
- Published: April 18, 2026 at 02:16:11 AM UTC
- Last modified: April 18, 2026 at 02:16:11 AM UTC
- CVSS v3.1: Base Score 6.4, Medium —
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication / Privileges / User Interaction:
- Authentication: required (authenticated user)
- Privileges Required: Low (PR:L) — description states Subscriber-level access and above can exploit
- User Interaction: None (UI:N)
- Primary impact: Confidentiality: Low; Integrity: Low; Availability: None
- Weakness (CWE): CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
The vulnerability is a stored cross-site scripting issue caused by insufficient input sanitization and output escaping of the checkin_place_id parameter. Because input provided by authenticated users is stored and later rendered in pages without proper escaping, arbitrary web scripts can be injected and executed in the context of other users viewing those pages.
Code locations referenced in the advisory include plugin files such as includes/public/core/class-youzify-wall.php and includes/public/core/wall/class-youzify-form.php. The affected parameter and the lack of adequate sanitization/escaping are the root cause; the vulnerability is triggered when stored input is output to a page without proper encoding.
The practical impact is execution of attacker-supplied scripts in victims browsers when they load an injected page. This can be used to perform actions available to the victim in the browser context or to steal data accessible to that browser session, limited by the browser same-origin model and the privileges of the affected user account.
How This Could Impact Your Website
Consider a small WordPress site with a site owner, an internal content editor, and an external contributor. If an authenticated contributor or subscriber posts or updates a check-in or similar content with a malicious payload in the checkin_place_id parameter, that payload may be stored and later executed when an editor or administrator views the page. Consequences can include exposure of data available to the viewing user in their browser session, and increased risk of targeted phishing or social engineering using harvested email addresses or session-relevant information.
This vulnerability does not, by itself, imply full site takeover, but it does raise the risk of credential theft or unwanted actions performed through a victim’s browser. If you're unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor and subscriber accounts with posting privileges.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins and themes.
- Monitor site activity and logs for unusual behavior, such as unexpected posts or changes from low-privilege accounts.
If you'd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/youzify/tags/1.3.6/includes/public/core/class-youzify-wall.php#L109
- https://plugins.trac.wordpress.org/browser/youzify/tags/1.3.6/includes/public/core/wall/class-youzify-form.php#L506
- https://plugins.trac.wordpress.org/browser/youzify/trunk/includes/public/core/class-youzify-wall.php#L109
- https://plugins.trac.wordpress.org/browser/youzify/trunk/includes/public/core/wall/class-youzify-form.php#L506
- https://plugins.trac.wordpress.org/changeset/3483281/youzify/trunk/includes/public/core/wall/class-youzify-form.php
- https://plugins.trac.wordpress.org/changeset?old_path=%2Fyouzify/tags/1.3.6&new_path=%2Fyouzify/tags/1.3.7
- https://www.wordfence.com/threat-intel/vulnerabilities/id/6bd69711-8303-4086-87c3-eb2935a89aff?source=cve
