CVE-2022-3832

The External Media WordPress plugin before 1.0.36 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2021-25074 WebP Converter for Media < 4.0.3 - Unauthenticated Open redirect

The WebP Converter for Media WordPress plugin before 4.0.3 contains a file passthru.php which does not validate the src parameter before redirecting the user to it, leading to an Open Redirect issue...

PT-2021-15848

Name of the Vulnerable Software and Affected Versions External Media WordPress plugin versions prior to 1.0.34 Description The issue concerns the wp ajax upload-remote-file AJAX action, which allowed arbitrary file uploads by any authenticated user. Recommendations For versions prior to 1.0.34,...

N-Media Website Contact Form with File Upload - Arbitrary File Upload

The website-contact-form-with-file-upload WordPress plugin was affected by an Arbitrary File Upload security vulnerability. PoC...