CVE-2024-2864 WordPress Youzify - Buddypress Moderation plugin <= 1.2.5 - Unauthenticated Cross Site Scripting (XSS) vulnerability

What is CVE-2024-2864?

CVE-2024-2864 is a high-severity cross-site scripting vulnerability in KaineLabs Youzify - Buddypress Moderation, published on 25 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in KaineLabs Youzify - Buddypress Moderation.This issue affects Youzify - Buddypress Moderation: from n/a through 1.2.5.

Weakness: CWE-79

Which versions are affected by CVE-2024-2864?

It affects 1 product.

Products include Kainelabs Youzify.

How do I fix CVE-2024-2864?

No fix has been published for CVE-2024-2864 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2024-2864 being exploited?

There is no known exploitation of CVE-2024-2864 in the wild and no public exploit code.

Other vulnerabilities in KaineLabs Youzify - Buddypress Moderation

• CVE-2022-1950 Youzify < 1.2.0 - Unauthenticated SQLi Critical 9.8
• CVE-2024-37494 WordPress Youzify plugin <= 1.2.5 - SQL Injection vulnerability High 8.5
• CVE-2024-13370 Missing authorization in Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress Medium 6.5
• CVE-2024-4742 SQL injection in Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress Medium 6.5
• CVE-2023-47191 WordPress Youzify Plugin <= 1.2.2 is vulnerable to Insecure Direct Object References (IDOR) Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-jwg9-66jx-hjp3.