WordPress Plugin Vulnerabilities

Slug
Published
Title
Slug
media-library-plus
Published
2025-02-14
Title
Media Library Folders < 8.3.1 - Missing Authorization to Plugin Settings Change
Slug
media-library-plus
Published
2026-02-13
Title
Media Library Folders < 8.3.7 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Attachment Deletion and Rename
Slug
media-library-tools
Published
2024-10-31
Title
Media Library Tools < 1.5.0 - Author+ Stored XSS via SVG
Slug
media-library-tools
Published
2025-12-11
Title
Media Library Tools < 1.7.0 - Authenticated (Author+) SQL Injection
Slug
media-list
Published
2023-11-03
Title
Medialist < 1.4.1 - Contributor+ Stored XSS
Slug
media-list
Published
2023-11-08
Title
Medialist < 1.4.0 - Contributor+ Stored XSS
Slug
media-mirror
Published
2021-08-09
Title
Titan Framework <= 1.12.1 - Reflected Cross-Site Scripting (XSS)
Slug
media-modal
Published
2024-10-31
Title
Media Modal <= 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Slug
media-net-ads-manager
Published
2024-07-26
Title
Media.net Ads Manager <= 2.10.13 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload
Slug
media-player-addons-for-elementor
Published
2025-09-16
Title
Media Player Addons for Elementor < 1.0.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widget Fields
Slug
media-search-enhanced
Published
2026-01-07
Title
Media Search Enhanced < 0.9.2 - Authenticated (Author+) SQL Injection
Slug
media-slider
Published
2024-06-06
Title
Media Slider – Photo Sleder, Video Slider, Link Slider, Carousal Slideshow < 1.4.0 - Missing Authorization
Slug
media-sync
Published
2026-05-13
Title
Media Sync < 1.5.0 - Authenticated (Author+) Path Traversal via 'sub_dir' and 'media_items' Parameters
Slug
media-tags
Published
2021-10-25
Title
Media-Tags <= 3.2.0.2 - Admin+ Stored Cross-Site Scripting
Slug
media-usage
Published
2021-08-13
Title
Media Usage <= 0.0.4 - Reflected Cross-Site Scripting
Slug
mediabay
Published
2025-06-05
Title
Mediabay - WordPress Media Library Folders <= 1.4 - Reflected Cross-Site Scripting
Slug
mediabay
Published
2025-07-15
Title
Mediabay - WordPress Media Library Folders <= 1.4 - Authenticated (Subscriber+) SQL Injection
Slug
mediabay-lite
Published
2023-10-16
Title
Mediabay <= 1.6 - Editor+ Stored XSS
Slug
mediabay-lite
Published
2023-10-24
Title
Mediabay <= 1.6 - Missing Authorization via AJAC actions
Slug
mediaburst-ecommerce-sms-notifications
Published
2017-12-14
Title
Multiple Mediaburst/Clockwork Plugins - Cross-Site Scripting (XSS)
Slug
mediaburst-email-to-sms
Published
2017-12-14
Title
Multiple Mediaburst/Clockwork Plugins - Cross-Site Scripting (XSS)
Slug
mediaburst-email-to-sms
Published
2023-12-21
Title
Clockwork SMS Notfications <= 3.0.4 - Authenticated(Administrator+) SQL Injection
Slug
mediacommander
Published
2025-12-12
Title
MediaCommander – Bring Folders to Media, Posts, and Pages < 2.4.0 - Missing Authorization to Authenticated (Author+) Media Folder Deletion
Slug
mediamatic
Published
2021-11-15
Title
Mediamatic < 2.8.1 - Subscriber+ SQL Injection
Slug
mediamatic
Published
2023-05-22
Title
Mediamatic – Media Library Folders < 3.0 - Cross-Site Request Forgery