CVE-2021-24311

The CVE-2021-24311 entry concerns the WordPress External Media plugin prior to version 1.0.34. The vulnerability stems from the wp_ajax_upload-remote-file AJAX action, allowing authenticated users to upload arbitrary files. This could enable execution or storage of attacker-supplied content, depe...

CVE-2022-3832

CVE-2022-3832 affects the External Media WordPress plugin prior to 1.0.36. The root cause is improper sanitisation/escaping of some plugin settings, enabling stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (such as in multisite setups). Documents consiste...