CVE-2022-3832

CVE-2022-3832 affects the External Media WordPress plugin prior to 1.0.36. The root cause is improper sanitisation/escaping of some plugin settings, enabling stored XSS by high-privilege users (e.g., admins) even when unfiltered_html is disallowed (such as in multisite setups). Documents consiste...

CVE-2021-24311

The External Media WordPress plugin, in versions prior to 1.0.34 , is vulnerable to an authenticated arbitrary file upload vulnerability. The flaw exists within the wp_ajax_upload-remote-file AJAX action, allowing any authenticated user to upload files to the server. This vulnerability can lead t...