WP Vulnerability WatchVulnerability data as of September 7, 2026

Known vulnerabilities in Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress

The best BuddyPress plugin for building online communities, user profile, social networks, and membership sites on WordPress with tons of features.

15Reported vulnerabilities
9.9Highest CVSS score
1.3.7Latest version
5,000+Active installs

What to do now

Update Youzify – BuddyPress Community, User Profile, Social Network & Membership Plugin for WordPress to 1.3.7 or later. 13 of these have a fixed version available. Updating resolves them.

Plugin last updated: March 15, 2026 / Tested up to WordPress: 6.9.7 / View on wordpress.org

Reported vulnerabilities

Ordered by how urgently they need attention — whether a vulnerability is actually being exploited, and how likely exploitation is, rather than CVSS severity alone.

CVESeverityExploit probability
next 30 days		 Affected versionsFixed inPublished
CVE-2022-1950 Critical 9.8 5.5% Before 1.2.0 1.2.0 August 1, 2022
CVE-2024-37494 Critical 9.9 0.5% 1.2.5 and earlier 1.2.6 July 4, 2024
CVE-2023-0059 Medium 5.4 0.5% Before 1.2.2 1.2.2 February 21, 2023
CVE-2021-24443 Medium 5.4 0.6% Before 1.0.7 1.0.7 August 2, 2021
CVE-2026-73397 High 8.1 0.4% 1.3.7 and earlier — August 18, 2026
CVE-2024-4742 Medium 6.5 0.5% 1.2.5 and earlier 1.2.6 June 20, 2024
CVE-2024-13370 Medium 6.5 0.4% 0 to 1.3.3 (inclusive) 1.3.4 January 25, 2025
CVE-2023-47191 Medium 6.5 0.4% Before 1.2.3 1.2.3 December 21, 2023
CVE-2026-1559 Medium 6.4 0.2% 0 to 1.3.6 (inclusive) 1.3.7 April 18, 2026
CVE-2025-69014 Medium 6.4 0.2% 1.3.7 and earlier — December 27, 2025
CVE-2024-8987 Medium 5.4 0.3% 0 to 1.3.0 (inclusive) 1.3.1 October 10, 2024
CVE-2024-13368 Medium 4.3 0.3% 0 to 1.3.4 (inclusive) 1.3.5 January 25, 2025
CVE-2024-12113 Medium 4.3 0.3% 0 to 1.3.2 (inclusive) 1.3.3 January 25, 2025
CVE-2024-9067 Medium 4.3 0.3% 0 to 1.3.0 (inclusive) 1.3.1 October 10, 2024
CVE-2024-39635 Medium 4.3 0.4% 1.2.6 and earlier 1.2.8 July 24, 2024

Sources: vulnerability records from NVD, exploitation from CISA KEV, exploit probability from EPSS. Affected versions come from CPE ranges or from the reporting CNA.