Skip to content
OpenAdvisories

Vendor

WP Media

14 known vulnerabilities.

Products

BackWPup – WordPress Backup & Restore Plugin 6 WP Rocket 4 LazyLoad Plugin – Lazy Load Images, Videos, and Iframes 1 Adminimize 1 Rocket Lazy Load 1 BackWPup 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.2
    CVE-2026-100196

    LazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content

    The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment_content (rendered inline into the page HTML)' parameter in all versions up to, and including, 2.4.0 due to insuffici…

    WP Media LazyLoad Plugin – Lazy Load Images, Videos, and Iframes Web / CMS
  • High 7.5
    CVE-2026-97076

    WordPress WP Rocket plugin < 3.23.5 - Denial of Service Attack vulnerability

    Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection.This issue affects WP Rocket: from n/a before 3.23.5.

    WP Media WP Rocket
  • High 7.2
    CVE-2026-5934

    WP Rocket <= 3.21.0.1 - Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon Endpoint

    The WP Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.21.0.1. This is due to insufficient input sanitization and output escaping of user-supplied data via the rocket_beacon AJAX endpoint. This make…

    WP Media WP Rocket Web / CMS
  • High 7.1
    CVE-2026-65443

    WordPress BackWPup plugin <= 5.7.4 - Cross Site Scripting (XSS) vulnerability

    Unauthenticated Cross Site Scripting (XSS) in BackWPup <= 5.7.4 versions.

    WP Media BackWPup
  • High 7.2
    CVE-2026-6227 Public exploit

    BackWPup <= 5.6.6 - Authenticated (Administrator+) Local File Inclusion via 'block_name' Parameter

    The BackWPup plugin for WordPress is vulnerable to Local File Inclusion via the `block_name` parameter of the `/wp-json/backwpup/v1/getblock` REST endpoint in all versions up to, and including, 5.6.6 due to a non-recursive `str_replace()` sanitization of path…

    WP Media BackWPup – WordPress Backup & Restore Plugin Web / CMS
  • High 7.2
    CVE-2025-15041

    BackWPup <= 5.6.2 - Authenticated (BackWPup Helper+) Privilege Escalation via Arbitrary Options Update

    The BackWPup – WordPress Backup & Restore Plugin plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the save_site_option() function in all versions up to, and incl…

    WP Media BackWPup – WordPress Backup & Restore Plugin Web / CMS
  • High 8.7
    CVE-2023-5504

    BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal

    The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the Log File Folder. This allows authenticated attackers to store backups in arbitrary folders on the server provided they can be written to by …

    WP Media BackWPup – WordPress Backup & Restore Plugin Web / CMS