WM
Vendor
WP Media
16
CVEs
0
On KEV
4
New 30D
Products
WR7.5
WP Rocket
WP Media
4 CVEs0 on KEV2 new
LP7.2
LazyLoad Plugin – Lazy Load Images, Videos, and Iframes
wp_media
1 CVEs0 on KEV1 new
RL6.5
Rocket Lazy Load
WP Media
1 CVEs0 on KEV1 new
BW8.7
BackWPup – WordPress Backup & Restore Plugin
wp_media
6 CVEs0 on KEV0 new
SR9.8
Search & Replace
Wp-media
2 CVEs0 on KEV0 new
AD4.3
Adminimize
WP Media
1 CVEs0 on KEV0 new
BA7.1
BackWPup
WP Media
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-100196 | LP LazyLoad Plugin – Lazy Load Images, Videos, and Iframes wp_media | 7.2 | Oct 10 | LazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content |
| CVE-2026-97075 | WR WP Rocket WP Media | 6.5 | Oct 9 | WordPress WP Rocket plugin < 3.23.5 - Broken Access Control vulnerability |
| CVE-2026-97076 | WR WP Rocket WP Media | 7.5 | Oct 9 | WordPress WP Rocket plugin < 3.23.5 - Denial of Service Attack vulnerability |
| CVE-2026-105884 | RL Rocket Lazy Load WP Media | 6.5 | Oct 7 | WordPress Rocket Lazy Load plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-5934 | WR WP Rocket WP Media | 7.2 | Aug 28 | WP Rocket <= 3.21.0.1 - Unauthenticated Stored Cross-Site Scripting via Picture Source Attributes in rocket_beacon Endpoint |
| CVE-2026-65443 | BA BackWPup WP Media | 7.1 | Jul 27 | WordPress BackWPup plugin <= 5.7.4 - Cross Site Scripting (XSS) vulnerability |
| CVE-2026-49045 | AD Adminimize WP Media | 4.3 | May 27 | WordPress Adminimize plugin <= 1.11.11 - Broken Access Control vulnerability |
| CVE-2026-6227 | BW BackWPup – WordPress Backup & Restore Plugin wp_media | 7.2 | Apr 14 | BackWPup <= 5.6.6 - Authenticated (Administrator+) Local File Inclusion via 'block_name' Parameter |
| CVE-2026-28044 | WR WP Rocket WP Media | 5.9 | Mar 19 | WordPress WP Rocket plugin <= 3.19.4 - Cross Site Scripting (XSS) vulnerability |
| CVE-2025-15041 | BW BackWPup – WordPress Backup & Restore Plugin wp_media | 7.2 | Feb 19 | BackWPup <= 5.6.2 - Authenticated (BackWPup Helper+) Privilege Escalation via Arbitrary Options Update |
| CVE-2025-10579 | BW BackWPup – WordPress Backup & Restore Plugin wp_media | 5.3 | Oct 25 | BackWPup <= 5.5.0 - Missing Authorization to Sensitive Information Exposure |
| CVE-2023-5505 | BW BackWPup – WordPress Backup & Restore Plugin wp_media | 6.8 | Aug 17 | BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal |
| CVE-2024-38759 | SR Search & Replace Wp-media | 9.8 | Jul 22 | WordPress Search & Replace plugin <= 3.2.2 - Deserialization of untrusted data vulnerability |
| CVE-2024-4145 | SR Search & Replace Wp-media | 7.2 | Jun 13 | Search & Replace < 3.2.2 - Admin+ SQL injection |
| CVE-2023-5775 | BW BackWPup – WordPress Backup & Restore Plugin wp_media | 2.7 | Feb 24 | BackWPup <= 4.0.2 - Plaintext Storage of Backup Destination Password |
| CVE-2023-5504 | BW BackWPup – WordPress Backup & Restore Plugin wp_media | 8.7 | Jan 11 | BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal |