45 matches found
blind-xxe-controller-CVE-2021-29447
Blind XXE controller I make this controller on doing metatwo machine in HackTheBox to exploiting CVE-2021-29447 which Is a WordPress XXE Vulnerability in Media Library affected version 5.7, 5.6.2, 5.6.1, 5.6, 5.0.11. where an authenticated user with ability to upload media library can upload...
CVE-2026-97294 WordPress Media LIbrary Assistant plugin <= 3.41 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in David Lingren Media LIbrary Assistant media-library-assistant allows Stored XSS.This issue affects Media LIbrary Assistant: from n/a through 3.41...
WordPress Media LIbrary Assistant plugin <= 3.41 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by nh4tvd in WordPress Plugin Media LIbrary Assistant versions = 3.41...
CVE-2026-97293
The WordPress Media Library Assistant plugin version 3.41 and below is vulnerable to a SQL Injection flaw within the Contributor role functionality. The vulnerability allows for unauthorized database interaction, potentially impacting confidentiality and availability. No specific exploit links or...
CVE-2026-97293 WordPress Media LIbrary Assistant plugin <= 3.41 - SQL Injection vulnerability
Contributor SQL Injection in Media LIbrary Assistant = 3.41 versions...
WordPress Media LIbrary Assistant plugin <= 3.41 - SQL Injection vulnerability
SQL Injection vulnerability discovered by Intrudify in WordPress Plugin Media LIbrary Assistant versions = 3.41...
WordPress Media Library Organizer plugin 2.0.4-2.1.3 - Contributor+ Arbitrary Taxonomy Term Creation vulnerability
Contributor+ Arbitrary Taxonomy Term Creation vulnerability discovered by Jashid Sany in WordPress Plugin Media Library Organizer - WordPress Media Library Folders & File Manager versions 2.0.4-2.1.3...
WordPress Media Library Folders plugin <= 8.4.1 - PHP Object Injection vulnerability
PHP Object Injection vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin Media Library Folders versions = 8.4.1...
CVE-2026-15004 FileBird – WordPress Media Library Folders & File Manager <= 6.5.6 - Authenticated (Author+) Stored Cross-Site Scripting
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 6.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
PT-2026-95286
Name of the Vulnerable Software and Affected Versions FileBird – WordPress Media Library Folders & File Manager versions prior to 6.5.7 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Author-level access and...
CVE-2026-15004: Improper Neutralization of Input During Web Page Generation
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via image alt text in all versions up to, and including, 6.5.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...
CVE-2026-17153
The AI Agent by SiteGround plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to upload images...
PT-2026-78887
The AI Agent by SiteGround plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to upload images...
CVE-2026-61963 WordPress Media LIbrary Assistant plugin <= 3.38 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Media LIbrary Assistant = 3.38 versions...
CVE-2026-14282: Unrestricted Upload of File with Dangerous Type
The GoDAM – Organize WordPress Media Library & File Manager with Unlimited Folders for Images, Videos & more plugin for WordPress is vulnerable to arbitrary file uploads in versions up to, and including, 1.12.2. This is due to insufficient file type validation in the savevideofile function hooked...
CVE-2026-11579: Unrestricted Upload of File with Dangerous Type
The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.17 does not verify that a file upload is made against an existing form configured with a file-upload field, accepting uploads regardless of whether any such form exists, which allows unauthenticated users to upload...
CVE-2025-12640
CVE-2025-12640 concerns the WordPress plugin Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager . According to Wordfence, versions up to 3.1.5 are affected by an unauthorized arbitrary media replacement vulnerability caused by missing object-level authorizati...
CVE-2025-28949: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Codedraft Mediabay - WordPress Media Library Folders allows Blind SQL Injection.This issue affects Mediabay - WordPress Media Library Folders: from n/a through 1.4...
CVE-2025-12900: Missing Authorization
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 6.5.1 via the "ConvertController::insertToNewTable" function due to missing validation on a user controlled key. This makes it possible f...
CVE-2025-11510: Improper Authorization
The FileBird – WordPress Media Library Folders & File Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the /filebird/v1/fb-wipe-clear-all-data function in all versions up to, and including, 6.4.9. This makes it possible for...