wp_media vulnerabilities

CVEs per yearBy the year they were published

1. 20243
2. 20251
3. 20263

Newest CVEs

• CVE-2026-100196

  LazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content

  wp_media · LazyLoad Plugin – Lazy Load Images, Videos, and Iframes

  High7.2
• CVE-2026-6227

  BackWPup <= 5.6.6 - Authenticated (Administrator+) Local File Inclusion via 'block_name' Parameter

  wp_media · BackWPup – WordPress Backup & Restore Plugin

  High7.2
• CVE-2025-15041

  BackWPup <= 5.6.2 - Authenticated (BackWPup Helper+) Privilege Escalation via Arbitrary Options Update

  wp_media · BackWPup – WordPress Backup & Restore Plugin

  High7.2
• CVE-2025-10579

  BackWPup <= 5.5.0 - Missing Authorization to Sensitive Information Exposure

  wp_media · BackWPup – WordPress Backup & Restore Plugin

  Medium5.3
• CVE-2023-5505

  BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal

  wp_media · BackWPup – WordPress Backup & Restore Plugin

  Medium6.8
• CVE-2023-5775

  BackWPup <= 4.0.2 - Plaintext Storage of Backup Destination Password

  wp_media · BackWPup – WordPress Backup & Restore Plugin

  Low2.2
• CVE-2023-5504

  BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal

  wp_media · BackWPup – WordPress Backup & Restore Plugin

  High8.7