Mediavine Control Panel Vulnerabilities

The Mediavine Control Panel plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.10.10. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 2.10.10

Fix:

No patched version reported

Disclosed:

Jul 22, 2026

CVE-2026-25424 on NVD →

The Mediavine Control Panel plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.10.6. This makes it possible for unauthenticated attackers to extract sensitive user or configuration data.

CVSS:

5.3

Affected:

up to 2.10.6

Fixed in:

2.10.7

Disclosed:

Apr 16, 2025

CVE-2025-39556 on NVD →

The Mediavine Control Panel plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.10.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts...

CVSS:

6.4

Affected:

up to 2.10.4

Fixed in:

2.10.5

Disclosed:

Aug 9, 2024

CVE-2024-43218 on NVD →

The Mediavine Control Panel plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.10.2. This is due to missing or incorrect nonce validation on the render_settings_page function. This makes it possible for unauthenticated attackers to clear the plugin's cache via a forged...

CVSS:

4.3

Affected:

up to 2.10.2

Fixed in:

2.10.3

Disclosed:

Sep 27, 2023

CVE-2023-44259 on NVD →