EUVD-2026-93232
GHSA-c845-4x9r-m572
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This is a moderate-priority web vulnerability, not a top-tier emergency. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C) correctly reflects a classic XSS profile: network-reachable, low complexity, no authentication, but requiring victim user interaction (clicking a crafted link or visiting a poisoned page), with a scope change as script executes in the victim's browser rather than the vulnerable server. Impact is rated Low across C/I/A, yielding the 7.1 (High) base score. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so there is no public exploit identified at time of analysis - meaning real-world exploitation signals are currently absent and the 7.1 is driven by the scope change plus unauthenticated reach rather than by evidence of active abuse. The signals are internally consistent (description 'Unauthenticated XSS' matches PR:N; UI:R is the natural brake on an XSS). One caveat: the input lists A:L (availability impact) for an XSS, which is atypical for reflected XSS and inflates the score slightly - verify whether JoomUnited/Patchstack intended availability impact or whether this is a scoring artifact. Net: patch on normal cadence; it is not a drop-everything issue absent exploitation evidence. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 06, 2026
Unauthenticated cross-site scripting in JoomUnited WP Media Folder through version 6.2.2 allows remote attackers to inject JavaScript that executes in a victim's browser when the victim interacts with a crafted page or request. The CVSS v3.1 score is 7.1 with AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicating network reachability, no authentication required, required user interaction, and limited confidentiality, integrity, and availability impact. No public exploit identified at time of analysis, and this is assessed as a moderate-priority web vulnerability rather than a top-tier emergency.
RemediationAI
Update the WP Media Folder plugin to a patched release as soon as one is confirmed; the provided data does not specify an exact fixed version, so verify the latest version against the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/wp-media-folder/vulnerability/wordpress-wp-media-folder-plugin-6-2-2-cross-site-scripting-xss-vulnerability?_s_id=cve. If a fixed version is not yet available or cannot be deployed immediately, disable the WP Media Folder plugin until patched, accepting the trade-off that media folder organization and related front-end features will be unavailable. As a temporary compensating control, restrict access to WordPress administrative and plugin-specific endpoints to trusted users or IP ranges, understanding that this does not eliminate the unauthenticated XSS path for public-facing pages. Deploy WAF or virtual patching rules to block XSS payloads targeting the plugin, but expect possible false positives and note that WAF bypasses are possible. Because exploitation requires user interaction, train users not to click untrusted links or open untrusted content while authenticated to WordPress.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-79, improper neutralization of input during web page generation, in the WordPress plugin WP Media Folder maintained by JoomUnited. The CPE cpe:2.3:a:joomunited:wp_media_folder:*:*:*:*:*:*:*:* identifies the affected component as JoomUnited WP Media Folder, with the advisory scoping vulnerable versions to 6.2.2 and earlier. The CVSS vector shows PR:N, so the attacker does not need credentials, but UI:R means successful exploitation depends on a victim visiting a malicious page or otherwise triggering the injected content. The scope change S:C reflects that the injected script runs in the context of the victim's browser and can affect resources beyond the original vulnerable component. The vulnerability was reported by Patchstack, and the primary reference is the Patchstack WordPress plugin database entry.
Know when Wp Media Folder gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Primary rating from Vendor (Patchstack) · only source for this CVE.
CVSS VectorVendor: Patchstack
DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.
Executive ViewAI
JoomUnited's WP Media Folder plugin, deployed on WordPress sites up to and including version 6.2.2, carries an unauthenticated cross-site scripting flaw (CVE-2026-32569, CVSS 7.1) for which no vendor fix has been released. Any site running this plugin - and any visitor, editor, or administrator who can be lured into interacting with a crafted page - is exposed, creating realistic paths to session hijacking, credential theft, and content tampering under a trusted domain. Because the plugin is commonly used to manage media libraries on content-heavy sites, leadership should treat this as a reputational and brand-trust risk, not merely a technical defect.
No vendor-released patch identified at time of analysis. Interim mitigations: deactivate or uninstall WP Media Folder where not operationally required; enforce WAF/edge virtual patching for script-injection payloads against the plugin's request paths; deploy a restrictive Content-Security-Policy and set cookies HttpOnly/SameSite; require MFA and network restriction for WordPress administrative and editor accounts; limit exposure by removing public-facing media browsing features until a fix ships; and monitor web logs and administrator sessions for anomalous script injection or account takeover indicators.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Exploit-DB