CVE-2026-118075

Contributor PHP Object Injection in WP Media folders = 1.1.10 versions...

EUVD-2026-112992

Contributor PHP Object Injection in WP Media folders = 1.1.10 versions...

CVE-2026-118075 WordPress WP Media folders plugin <= 1.1.10 - PHP Object Injection vulnerability

Contributor PHP Object Injection in WP Media folders = 1.1.10 versions...

CVE-2026-118075

The WP Media folders plugin for WordPress, affecting versions

CVE-2026-105884

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Media Rocket Lazy Load rocket-lazy-load allows Stored XSS.This issue affects Rocket Lazy Load: from n/a through 2.4.0...

EUVD-2026-94250

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Media Rocket Lazy Load rocket-lazy-load allows Stored XSS.This issue affects Rocket Lazy Load: from n/a through 2.4.0...

CVE-2026-105884: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Media Rocket Lazy Load rocket-lazy-load allows Stored XSS.This issue affects Rocket Lazy Load: from n/a through 2.4.0...

CVE-2026-32569

Unauthenticated Cross Site Scripting XSS in WP Media folder = 6.2.2 versions...

CVE-2026-32569 WordPress WP Media folder plugin <= 6.2.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WP Media folder = 6.2.2 versions...

CVE-2026-32569

The WP Media folder plugin for WordPress (versions

EUVD-2026-93232

Unauthenticated Cross Site Scripting XSS in WP Media folder = 6.2.2 versions...

CVE-2026-32569 WordPress WP Media folder plugin <= 6.2.2 - Cross Site Scripting (XSS) vulnerability

Unauthenticated Cross Site Scripting XSS in WP Media folder = 6.2.2 versions...

PT-2026-106397

Name of the Vulnerable Software and Affected Versions WP Media folder versions prior to 6.2.3 Description An unauthenticated Cross Site Scripting XSS issue exists, which allows an attacker to execute malicious scripts in the browser of a user by exploiting the way the software handles requests...

CVE-2026-32569: Improper Neutralization of Input During Web Page Generation

Unauthenticated Cross Site Scripting XSS in WP Media folder = 6.2.2 versions...

WordPress WP Media folder plugin <= 6.2.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin WP Media folder versions = 6.2.2...

CVE-2026-11974

The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage...

CVE-2026-11974: Improper Limitation of a Pathname to a Restricted Directory

The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage...

PT-2026-65690

The wp-media-folder-addon WordPress plugin through 4.1.6 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage...

CVE-2026-9690: Improper Limitation of a Pathname to a Restricted Directory

Unauthenticated Arbitrary File Download in WP Media folder Addon = 4.0.1 versions...

CVE-2026-49045: Missing Authorization

Missing Authorization vulnerability in WP Media Adminimize allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Adminimize: from n/a through 1.11.11...