Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

4 records

Vendor: devowl Component: Real Media Library Clear all filters
TI-2024-02163 CVE-2024-2328 · GHSA-h49x-p598-qj9g

Real Media Library <= 4.22.11 - Authenticated (Author+) Stored Cross-Site Scripting

Priority LOW 29

The Real Media Library: Media Library Folder & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the image title and alt text in all versions up to, and including, 4.22.11 due to insuffic…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00404 Published 2024-05-02 No fix listed CWE-79
TI-2024-01887 CVE-2024-2027 · GHSA-32gp-xwx5-8mwj

Improper input validation in devowl Real Media Library: Media Library Folder & File…

Priority LOW 29

The Real Media Library: Media Library Folder & File Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its style attributes in all versions up to, and including, 4.22.7 due to insufficient inpu…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00423 Published 2024-04-09 No fix listed CWE-20
TI-2023-00270 CVE-2023-0285 · GHSA-73xq-fm46-h4hh

Real Media Library < 4.18.29 - Author+ Stored XSS

Priority MEDIUM 58

The Real Media Library WordPress plugin before 4.18.29 does not sanitise and escape the created folder names, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00457 Published 2023-02-21 Fixed in 4.18.29 CWE-79
TI-2021-13681 CVE-2021-34668 · GHSA-7j9q-9jrq-65rh

WordPress Real Media Library <= 4.14.1 Author-only Stored Cross-Site Scripting

Priority LOW 29

The WordPress Real Media Library WordPress plugin is vulnerable to Stored Cross-Site Scripting via the name parameter in the ~/inc/overrides/lite/rest/Folder.php file which allows author-level attackers to inject arbitra…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0056 Published 2021-08-30 No fix listed CWE-79