WordPress Plugin Vulnerabilities

WordPress Real Media Library < 4.14.2 - Author Stored Cross-Site Scripting

Description

The plugin is vulnerable to Stored Cross-Site Scripting via the name parameter in the ~/inc/overrides/lite/rest/Folder.php file which allows author-level attackers to inject arbitrary web scripts in folder names.

Affects Plugins

Plugin icon
real-media-library-lite
Fixed in 4.14.2

References

CVE
CVE-2021-34668
URL
https://www.wordfence.com/vulnerability-advisories/#CVE-2021-34668

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
6.4 (medium)

Miscellaneous

Original Researcher
Thinkland Security Team
Verified
Yes
WPVDB ID
3ddfef64-b73c-4d55-b02d-a23284df0c1b

Timeline

Publicly Published
2021-08-25 (about 4 years ago)
Added
2021-08-25 (about 4 years ago)
Last Updated
2022-04-10 (about 4 years ago)

Other

Published
Title
Published
2020-08-31
Title
Chamber Dashboard Business Directory < 3.3.1 - Authenticated Stored Cross-Site Scripting
Published
2022-08-31
Title
Wordlift < 3.37.2 - Admin+ Stored Cross-Site Scripting
Published
2024-11-01
Title
Elo Rating Shortcode < 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-08-22
Title
WS Theme Addons <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via ws_weather Shortcode
Published
2025-09-05
Title
Smart Table Builder < 1.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter