CVE-2026-4912

The Media Cleaner: Clean your WordPress! plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.3. This is due to the geturlsfromhtml function using DOMDocument::loadHTMLFile to fetch iframe source URLs with an insufficient hostname validation...