97 matches found
CVE-2026-105884
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Media Rocket Lazy Load rocket-lazy-load allows Stored XSS.This issue affects Rocket Lazy Load: from n/a through 2.4.0...
EUVD-2026-94250
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in WP Media Rocket Lazy Load rocket-lazy-load allows Stored XSS.This issue affects Rocket Lazy Load: from n/a through 2.4.0...
CVE-2026-32569
Unauthenticated Cross Site Scripting XSS in WP Media folder = 6.2.2 versions...
CVE-2026-32569
The WP Media folder plugin for WordPress (versions
EUVD-2026-93232
Unauthenticated Cross Site Scripting XSS in WP Media folder = 6.2.2 versions...
CVE-2026-32569 WordPress WP Media folder plugin <= 6.2.2 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in WP Media folder = 6.2.2 versions...
WordPress WP Media folder plugin <= 6.2.2 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin WP Media folder versions = 6.2.2...
CVE-2026-11974
The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage...
PT-2026-65690
The wp-media-folder-addon WordPress plugin through 4.1.6 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage...
CVE-2026-11974: Improper Limitation of a Pathname to a Restricted Directory
The wp-media-folder-addon WordPress plugin before 4.1.7 does not validate a user-supplied parameter before using it in a file read operation in two AJAX actions available to unauthenticated users, leading to Arbitrary File Disclosure and Server-Side Request Forgery on sites where a cloud storage...
CVE-2026-9690: Improper Limitation of a Pathname to a Restricted Directory
Unauthenticated Arbitrary File Download in WP Media folder Addon = 4.0.1 versions...
CVE-2026-49045: Missing Authorization
Missing Authorization vulnerability in WP Media Adminimize allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Adminimize: from n/a through 1.11.11...
PT-2025-49997
Cross-Site Request Forgery CSRF vulnerability in wpmediadownload Media Library File Download media-download allows Cross Site Request Forgery.This issue affects Media Library File Download: from n/a through = 1.4...
EUVD-2025-199809
The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'ayschatgptsavewpmedia' function in all versions up to, and including, 2.7.0. This makes it possible for unauthenticated attackers to upload...
CVE-2025-60134
Cross-Site Request Forgery CSRF vulnerability in John James Jacoby WP Media Categories wp-media-categories allows Cross Site Request Forgery.This issue affects WP Media Categories: from n/a through = 2.1.0...
CVE-2025-60134
CVE-2025-60134 is a Cross‑Site Request Forgery (CSRF) vulnerability in the WordPress plugin WP Media Categories (wp-media-categories), affecting WP Media Categories from n/a through 2.1.0. The connected Red Hat/NVD entries describe a CSRF issue but do not provide a concrete fix/version or remedia...
CVE-2025-60134: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in John James Jacoby WP Media Categories wp-media-categories allows Cross Site Request Forgery.This issue affects WP Media Categories: from n/a through = 2.1.0...
EUVD-2015-2302
Malware in sbrugna...