An attacker can exploit a CSRF vulnerability in the Mediabay ‑ WordPress Media Library Folders plugin that allows a reflected XSS payload to be executed in the victim's browser. The flaw can be triggered by a forged request that contains malicious script, potentially enabling the attacker to steal session cookies, deface the site, or perform other client‑side attacks. This weakness is identified as CWE‑352.

The vulnerability affects all installations of codedraft Mediabay ‑ WordPress Media Library Folders from the earliest release through version 1.4 inclusive.

The CVSS score of 7.1 indicates a high impact, while the EPSS score of <1% indicates a low probability of exploitation in real‑world scenarios. The vulnerability is not yet catalogued in the CISA KEV list. The attack vector is a CSRF to reflected XSS scenario that requires a user with an authenticated WordPress session and the plugin enabled; a malicious webpage or link can trigger the forged request and the reflected payload. In practice, only systems with the Mediabay plugin enabled and accessible to user accounts are at risk, and exploitation would rely on social engineering or compromised sites to supply the forged request.