plugin

Filepicker Media Uploader Vulnerabilities

2 known security issues reported for the Filepicker Media Uploader WordPress plugin. Most recent disclosed Feb 18, 2026.

1 medium

Running Filepicker Media Uploader on your site? Check whether your installed version is affected.

Scan your site free

Filestack [filepicker-media-uploader] <= 2.0.8 (unfixed)

unknown

[en] The Filestack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'filepicker' shortcode in all versions up to, and including, 2.0.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contri...

Affected:
up to 2.0.8
Fix:
No patched version reported
Disclosed:
Feb 18, 2026

CVE-2025-13959 on NVD →

Filestack <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

medium

The Filestack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'filepicker' shortcode in all versions up to, and including, 2.0.8 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor...

CVSS:
6.4
Affected:
up to 2.0.8
Fix:
No patched version reported
Disclosed:
Feb 17, 2026

CVE-2025-13959 on NVD →

Protect your WordPress site

Run a free security scan to detect vulnerable plugins and themes, exposed files, and malware — no plugin install, no signup.

Scan your site free

← Back to the vulnerability database