Description
Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.
Published: 2026-10-06
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Cross Site Scripting
Action: Apply Patch
AI Analysis

Impact

Unauthenticated Cross Site Scripting occurs in the WP Media folder plugin versions 6.2.2 and earlier. The flaw allows an attacker to inject malicious scripts that are executed in the browser of any user who views a page processed by the plugin.

Affected Systems

WP Media folder plugin developed by Joomunited for WordPress. Versions up to and including 6.2.2 are affected.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity. The EPSS score is <1%, and the vulnerability is not listed in CISA's KEV catalog. The bug is unauthenticated and only requires the attacker to supply crafted input that will be rendered by a page served by the plugin. Anyone who can load such a page will be affected.

Generated by OpenCVE AI on October 7, 2026 at 06:01 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update the WP Media folder plugin to the latest version (6.2.3 or newer).
  • If an update is not feasible, disable the plugin or block its URLs via the web server.
  • Ensure any content handled by the plugin is properly sanitized and escaped before rendering to reduce similar XSS risks.

Generated by OpenCVE AI on October 7, 2026 at 06:01 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 06 Oct 2026 11:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 09:00:00 +0000

Type Values Removed Values Added
Description Unauthenticated Cross Site Scripting (XSS) in WP Media folder <= 6.2.2 versions.
Title WordPress WP Media folder plugin <= 6.2.2 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 7.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-10-06T10:31:42.269Z

Reserved: 2026-03-12T11:12:52.970Z

Link: CVE-2026-32569

cve-icon Vulnrichment

Updated: 2026-10-06T10:31:18.183Z

cve-icon NVD

Status : Deferred

Published: 2026-10-06T09:17:42.397

Modified: 2026-10-06T15:04:25.990

Link: CVE-2026-32569

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-07T06:15:12Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')