External Media Vulnerabilities

The External Media plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.36. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application which can be us...

CVSS:

6.4

Affected:

up to 1.0.36

Fix:

No patched version reported

Disclosed:

Nov 23, 2025

CVE-2025-49335 on NVD →

The External Media plugin for WordPress is vulnerable to File Upload due to insufficient file type validation in the isUnsafe function in versions up to, and including, 1.0.36. This makes it possible for authenticated attackers with the upload_files capability, such as authors, to upload dangerous file types such as un...

CVSS:

6.4

Affected:

up to 1.0.36

Fix:

No patched version reported

Disclosed:

Mar 30, 2023

The External Media plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.35 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in...

CVSS:

5.5

Affected:

up to 1.0.35

Fixed in:

1.0.36

Disclosed:

Nov 28, 2022

CVE-2022-3832 on NVD →

The wp_ajax_upload-remote-file AJAX action of the External Media WordPress plugin before 1.0.34 was vulnerable to arbitrary file uploads via any authenticated users.

CVSS:

8.8

Affected:

up to 1.0.34

Fixed in:

1.0.34

Disclosed:

May 13, 2021

CVE-2021-24311 on NVD →