Skip to main content

Wp Media

5 CVEs vendor

Monthly

CVE-2026-5934 Aug 28, 11:29 HIGH This Week

Stored Cross-Site Scripting in WP Rocket versions up to and including 3.21.0.1 allows unauthenticated remote attackers to inject persistent malicious scripts via the rocket_beacon AJAX endpoint. Any user who subsequently visits a page where the payload has been stored will execute the attacker-controlled script in their browser context. A patched release (v3.21.1) is available from WP Media, and no public exploit or active exploitation has been identified in the provided data.

WordPress XSS Wp Rocket Wp Media
NVD GitHub
CVSS 3.1
7.2
EPSS
0.2%
CVE-2026-6227 Apr 14, 02:25 HIGH This Week

Local file inclusion in BackWPup WordPress plugin versions ≤5.6.6 allows authenticated administrators to read sensitive configuration files or achieve remote code execution via path traversal bypass in the `/wp-json/backwpup/v1/getblock` REST endpoint. The vulnerability stems from insufficient sanitization using non-recursive `str_replace()`, enabling crafted sequences like `....//` to bypass filtering. While requiring high privileges (PR:H), the plugin's permission delegation feature allows administrators to grant backup management rights to lower-privileged users, expanding the attack surface. No public exploit or active exploitation (CISA KEV) confirmed at time of analysis, though CVSS 7.2 reflects high confidentiality, integrity, and availability impact.

PHP WordPress RCE Path Traversal Backwpup Wordpress Backup Restore Plugin +2
NVD
CVSS 3.1
7.2
EPSS
0.3%
CVE-2026-28044 Mar 19, 05:21 MEDIUM This Month

WP Rocket, a popular WordPress performance optimization plugin, contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to 3.19.4 that allows authenticated attackers with high privileges to inject malicious scripts into web pages. An attacker with administrator or equivalent access can craft specially-formatted input that bypasses input sanitization, resulting in persistent XSS that executes in the browsers of other site users. The vulnerability has a CVSS score of 5.9 (Medium), requiring high privileges and user interaction, with no evidence of active exploitation in the wild or public proof-of-concept code.

WordPress XSS Wp Rocket Wordpress Plugin Wp Media
NVD
CVSS 3.1
5.9
EPSS
0.0%
CVE-2024-38759 Jul 22, 11:15 CRITICAL Act Now

Deserialization of Untrusted Data vulnerability in WP MEDIA SAS Search & Replace search-and-replace.2.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Deserialization Search Replace Wp Media
NVD
CVSS 3.1
9.8
EPSS
0.3%
CVE-2024-4145 Jun 13, 06:15 HIGH POC This Week

The Search & Replace WordPress plugin before 3.2.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks (such as within a. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

WordPress SQLi Search Replace Wp Media
NVD WPScan
CVSS 3.1
7.2
EPSS
0.4%
EPSS 0% CVSS 7.2
HIGH This Week

Stored Cross-Site Scripting in WP Rocket versions up to and including 3.21.0.1 allows unauthenticated remote attackers to inject persistent malicious scripts via the rocket_beacon AJAX endpoint. Any user who subsequently visits a page where the payload has been stored will execute the attacker-controlled script in their browser context. A patched release (v3.21.1) is available from WP Media, and no public exploit or active exploitation has been identified in the provided data.

WordPress XSS Wp Rocket +1
NVD GitHub
EPSS 0% CVSS 7.2
HIGH This Week

Local file inclusion in BackWPup WordPress plugin versions ≤5.6.6 allows authenticated administrators to read sensitive configuration files or achieve remote code execution via path traversal bypass in the `/wp-json/backwpup/v1/getblock` REST endpoint. The vulnerability stems from insufficient sanitization using non-recursive `str_replace()`, enabling crafted sequences like `....//` to bypass filtering. While requiring high privileges (PR:H), the plugin's permission delegation feature allows administrators to grant backup management rights to lower-privileged users, expanding the attack surface. No public exploit or active exploitation (CISA KEV) confirmed at time of analysis, though CVSS 7.2 reflects high confidentiality, integrity, and availability impact.

PHP WordPress RCE +4
NVD
EPSS 0% CVSS 5.9
MEDIUM This Month

WP Rocket, a popular WordPress performance optimization plugin, contains a Stored Cross-Site Scripting (XSS) vulnerability in versions up to 3.19.4 that allows authenticated attackers with high privileges to inject malicious scripts into web pages. An attacker with administrator or equivalent access can craft specially-formatted input that bypasses input sanitization, resulting in persistent XSS that executes in the browsers of other site users. The vulnerability has a CVSS score of 5.9 (Medium), requiring high privileges and user interaction, with no evidence of active exploitation in the wild or public proof-of-concept code.

WordPress XSS Wp Rocket +2
NVD
EPSS 0% CVSS 9.8
CRITICAL Act Now

Deserialization of Untrusted Data vulnerability in WP MEDIA SAS Search & Replace search-and-replace.2.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

Deserialization Search Replace Wp Media
NVD
EPSS 0% CVSS 7.2
HIGH POC This Week

The Search & Replace WordPress plugin before 3.2.2 does not sanitize and escape a parameter before using it in a SQL statement, allowing admins to perform SQL injection attacks (such as within a. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

WordPress SQLi Search Replace +1
NVD WPScan

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy