PT-2026-48552

Copy & Delete Posts through 1.5.4 lets any plugin-enabled non-admin role invoke every operation in the cdp action handling AJAX handler. Attackers with an enabled role can delete posts or overwrite plugin settings via the f parameter, bypassing per-function capability checks...

PT-2025-7472

Name of the Vulnerable Software and Affected Versions WP Media Category Management plugin versions 2.0 to 2.3.3 Description The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the wp mcm handle action settings function. This allows unauthenticated...

CVE-2025-0865: Cross-Site Request Forgery (CSRF)

The WP Media Category Management plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions 2.0 to 2.3.3. This is due to missing or incorrect nonce validation on the wpmcmhandleactionsettings function. This makes it possible for unauthenticated attackers to alter plugin settings...