The Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress contains a stored cross-site scripting vulnerability identified as CVE-2026-1559. This vulnerability is due to insufficient input sanitization and output escaping of the 'checkin_place_id' parameter in all versions up to and including 1.3.6. Authenticated attackers with Subscriber-level privileges or higher can inject arbitrary web scripts that execute when users access the injected pages. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required. The vulnerability impacts confidentiality and integrity but not availability.

An attacker with at least Subscriber-level access can inject persistent malicious scripts into pages via the 'checkin_place_id' parameter. These scripts execute in the context of users visiting the affected pages, potentially leading to session hijacking, unauthorized actions, or data disclosure. The vulnerability affects confidentiality and integrity but does not impact availability. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access where possible and monitor for suspicious activity related to the 'checkin_place_id' parameter. Avoid using or exposing this parameter in untrusted contexts. Follow updates from the Youzify plugin vendor for official patches or mitigations.