CVE-2019-11869: Yuzopro Yuzo

Medium severity, CVSS 6.1. EPSS: 4.5% chance of exploitation in the next 30 days.

The Yuzo Related Posts plugin 5.12.94 for WordPress has XSS because it mistakenly expects that is_admin() verifies that the request comes from an admin user (it actually only verifies that the request is for an admin page). An unauthenticated attacker can inject a payload into the plugin settings, such as the yuzo_related_post_css_and_style setting.

Affected products

• Yuzopro Yuzo: version 5.12.94 only

Published 2019-05-09. Last modified 2026-06-17.