WP Media vulnerabilities
We track 6 vulnerabilities in WP Media products across 3 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on October 10, 2026.
Latest WP Media vulnerabilities
- 7.2 High severity
LazyLoad Plugin – Lazy Load Images, Videos…: Improper Neutralization of Input During Web Page Generation
The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment_content (rendered inline into the page HTML)' parameter in all versions up to, and including, 2.4.0 due to insufficie
- 7.5 High severity
WP Rocket: Executable Regular Expression Error
Executable Regular Expression Error vulnerability in WP Media WP Rocket wp-rocket allows Code Injection.This issue affects WP Rocket: from n/a before 3.23.5.
- 7.2 High severity
WP Rocket: Improper Neutralization of Input During Web Page Generation
The WP Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.21.0.1. This is due to insufficient input sanitization and output escaping of user-supplied data via the rocket_beacon AJAX endpoint. This makes
- 7.2 High severity
BackWPup – WordPress Backup & Restore Plugin: Improper Limitation of a Pathname to a Restricted Directory
The BackWPup plugin for WordPress is vulnerable to Local File Inclusion via the `block_name` parameter of the `/wp-json/backwpup/v1/getblock` REST endpoint in all versions up to, and including, 5.6.6 due to a non-recursive `str_replace()` sanitization of path
- 7.2 High severity
BackWPup – WordPress Backup & Restore Plugin: Missing Authorization
The BackWPup – WordPress Backup & Restore Plugin plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the save_site_option() function in all versions up to, and inclu
- 8.7 High severity
BackWPup – WordPress Backup & Restore Plugin: Improper Limitation of a Pathname to a Restricted Directory
The BackWPup plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 4.0.1 via the Log File Folder. This allows authenticated attackers to store backups in arbitrary folders on the server provided they can be written to by t