Nmedia vulnerabilities
We track 6 vulnerabilities in Nmedia products across 2 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on June 28, 2026.
Latest Nmedia vulnerabilities
- 8.1 High severity
Frontend File Manager Plugin: External Control of File Name or Path
The Frontend File Manager Plugin plugin for WordPress is vulnerable to Authenticated Arbitrary File Deletion in versions up to and including 23.6. This is due to a case-sensitive bypass of the wpfm_dir_path parameter sanitization in the wpfm_file_meta_update A
- 7.5 High severity
Frontend File Manager Plugin: Missing Authorization
The Frontend File Manager Plugin for WordPress is vulnerable to unauthorized file sharing due to a missing capability check on the 'wpfm_send_file_in_email' AJAX action in all versions up to, and including, 23.5. This makes it possible for unauthenticated atta
- 8.8 High severity
Simple User Registration: Improper Access Control
The Simple User Registration plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 6.7 due to insufficient restriction on the 'profile_save_field' function. This makes it possible for authenticated attackers, with minimal
- 7.2 High severity
Simple User Registration: Improper Neutralization of Input During Web Page Generation
The Simple User Registration plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'wpr_admin_msg' parameter in all versions up to, and including, 6.6 due to insufficient input sanitization and output escaping. This makes it possible for un
- 7.5 High severity
Frontend File Manager Plugin: Missing Authorization
The Frontend File Manager Plugin plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the wpfm_delete_multiple_files() function in all versions up to, and including, 21.5. This makes it possible for unauthenticat
- 9.8 Critical severity
Simple User Registration: Improper Privilege Management
The Simple User Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3. This is due to insufficient restrictions on user meta values that can be supplied during registration. This makes it possible for