WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
mediabay
Published
2025-07-15
Title
Mediabay - WordPress Media Library Folders <= 1.4 - Authenticated (Subscriber+) SQL Injection
Slug
mediabay-lite
Published
2023-10-16
Title
Mediabay <= 1.6 - Editor+ Stored XSS
Slug
mediabay-lite
Published
2023-10-24
Title
Mediabay <= 1.6 - Missing Authorization via AJAC actions
Slug
mediaburst-ecommerce-sms-notifications
Published
2017-12-14
Title
Multiple Mediaburst/Clockwork Plugins - Cross-Site Scripting (XSS)
Slug
mediaburst-email-to-sms
Published
2017-12-14
Title
Multiple Mediaburst/Clockwork Plugins - Cross-Site Scripting (XSS)
Slug
mediaburst-email-to-sms
Published
2023-12-21
Title
Clockwork SMS Notfications <= 3.0.4 - Authenticated(Administrator+) SQL Injection
Slug
mediacommander
Published
2025-12-12
Title
MediaCommander – Bring Folders to Media, Posts, and Pages < 2.4.0 - Missing Authorization to Authenticated (Author+) Media Folder Deletion
Slug
mediamatic
Published
2021-11-15
Title
Mediamatic < 2.8.1 - Subscriber+ SQL Injection
Slug
mediamatic
Published
2023-05-22
Title
Mediamatic – Media Library Folders <= 2.8.1 - Cross-Site Request Forgery
Slug
mediapress
Published
2025-09-03
Title
MediaPress < 1.6.0 - Authenticated (Contributor+) Local File Inclusion
Slug
mediapress
Published
2026-01-05
Title
MediaPress < 1.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Plugin's Shortcode
Slug
mediapress
Published
2026-01-07
Title
MediaPress < 1.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
mediaview
Published
2025-03-26
Title
MediaView < 1.1.3 - Reflected Cross-Site Scripting via id Parameter
Slug
mediaview
Published
2025-04-02
Title
MediaView < 1.1.3 - Reflected Cross-Site Scripting
Slug
mediavine-control-panel
Published
2024-08-09
Title
Mediavine Control Panel < 2.10.5 - Contributor+ Stored XSS
Slug
mediavine-control-panel
Published
2025-04-16
Title
Mediavine Control Panel < 2.10.7 - Unauthenticated Information Exposure
Slug
mediavine-create
Published
2024-03-19
Title
create by mediavine < 1.9.5 - Unauthenticated SQLi
Slug
mediavine-create
Published
2024-06-26
Title
Create by Mediavine < 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Schema Meta Shortcode
Slug
mediavine-create
Published
2024-07-04
Title
Create by Mediavine < 1.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
mediavine-create
Published
2024-08-12
Title
Create by Mediavine < 1.9.9 - Unauthenticated Sensitive Information Exposure
Slug
mediavine-create
Published
2025-08-30
Title
Create by Mediavine <= 1.9.15 - Unauthenticated Insecure Direct Object Reference
Slug
medibazar-core
Published
2023-12-07
Title
Multiple Plugins by KlbTheme - Reflected Cross-Site Scripting
Slug
medical-addon-for-elementor
Published
2024-09-24
Title
Medical Addon for Elementor <= 1.6.4 - Contributor+ Stored XSS
Slug
medical-addon-for-elementor
Published
2025-02-03
Title
Medical Addon for Elementor < 1.6.3 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode
Slug
medical-addon-for-elementor
Published
2025-08-01
Title
Medical Addon for Elementor < 1.6.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Typewriter Widget