CVE-2026-39780: WordPress Youzify plugin <= 1.3.7 - Cross Site Scripting (XSS) vulnerability

Q: Who can exploit this issue?

The vulnerability is unauthenticated, so an attacker does not need a WordPress account or prior access to the site. Exploitation still requires user interaction, as reflected by the UI:R vector.

Q: What security impact can exploitation have?

The vulnerability can affect confidentiality, integrity, and availability at low impact levels. Its CVSS vector also indicates that the impact may extend beyond the vulnerable component's security authority (S:C).

Q: Which installations are known to be affected?

Youzify plugin versions 1.3.7 and earlier are identified as affected. The provided data does not state whether a particular plugin configuration is required.

Published Oct 6, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in Youzify <= 1.3.7 versions.

Affected Software

1 affected component

Youzify Youzify plugin<=1.3.7

Event History

Oct 6, 2026

CVE Published

via MITRE·08:34 AM

Data Sourced

via MITRE·08:34 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

The vulnerability is unauthenticated, so an attacker does not need a WordPress account or prior access to the site. Exploitation still requires user interaction, as reflected by the UI:R vector.

What security impact can exploitation have?

The vulnerability can affect confidentiality, integrity, and availability at low impact levels. Its CVSS vector also indicates that the impact may extend beyond the vulnerable component's security authority (S:C).

Which installations are known to be affected?