{"schema_version":1,"title":"WP Media vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 8 vulnerabilities in WP Media: 0 in the last 7 days and 6 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-114431, was published on 4 November 2026. 2 vulnerabilities in the last four weeks, down 33% on the four before (3). 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/wp-media","json_url":"https://junglewise.ai/threats/vendors/wp-media.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/wp-media","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","thin":false,"counts":{"high":4,"all_time":8,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":2,"last_90_days":6,"last_365_days":8},"latest":[{"cve":"CVE-2026-114431","slug":"cve-2026-114431-the-enable-media-replace-wordpress-plugin-before-4-2-3-does-not","title":"Enable Media Replace stored XSS via SVG upload bypass","severity":"info","exploited":false,"published_at":"2026-11-04T06:17:00.867+00:00","url":"https://junglewise.ai/threats/cve-2026-114431-the-enable-media-replace-wordpress-plugin-before-4-2-3-does-not"},{"cve":"CVE-2026-111464","cvss":5.9,"slug":"cve-2026-111464-the-wp-fastest-cache-plugin-for-wordpress-is-vulnerable-to","title":"WP Fastest Cache sensitive information exposure in caching","severity":"medium","exploited":false,"published_at":"2026-11-03T03:16:42.977+00:00","url":"https://junglewise.ai/threats/cve-2026-111464-the-wp-fastest-cache-plugin-for-wordpress-is-vulnerable-to"},{"cve":"CVE-2026-97075","cvss":6.5,"epss":0.0016,"slug":"cve-2026-97075-missing-authorization-vulnerability-in-wp-media-wp-rocket-wp","title":"WP Media WP Rocket broken access control","severity":"medium","exploited":false,"published_at":"2026-10-09T08:16:55.683+00:00","url":"https://junglewise.ai/threats/cve-2026-97075-missing-authorization-vulnerability-in-wp-media-wp-rocket-wp"},{"cve":"CVE-2026-97076","cvss":7.5,"epss":0.0029,"slug":"cve-2026-97076-executable-regular-expression-error-vulnerability-in-wp-media-wp","title":"WP Media WP Rocket code injection in regular expression","severity":"high","exploited":false,"published_at":"2026-10-09T07:17:19.35+00:00","url":"https://junglewise.ai/threats/cve-2026-97076-executable-regular-expression-error-vulnerability-in-wp-media-wp"},{"cve":"CVE-2026-32569","cvss":7.1,"slug":"cve-2026-32569-unauthenticated-cross-site-scripting-xss-in-wp-media-folder-6-2-2","title":"WP Media folder cross-site scripting (XSS)","severity":"high","exploited":false,"published_at":"2026-10-06T09:17:42.397+00:00","url":"https://junglewise.ai/threats/cve-2026-32569-unauthenticated-cross-site-scripting-xss-in-wp-media-folder-6-2-2"},{"cve":"CVE-2026-5934","cvss":7.2,"epss":0.0032,"slug":"cve-2026-5934-wp-rocket-stored-cross-site-scripting-in-rocket-beacon-endpoint","title":"WP Rocket stored cross-site scripting in rocket_beacon endpoint","severity":"high","exploited":false,"published_at":"2026-08-28T16:18:19.657+00:00","url":"https://junglewise.ai/threats/cve-2026-5934-wp-rocket-stored-cross-site-scripting-in-rocket-beacon-endpoint"},{"cve":"CVE-2026-65443","cvss":7.1,"slug":"cve-2026-65443-wp-media-backwpup-unauthenticated-xss","title":"WP Media BackWPup unauthenticated XSS","severity":"high","exploited":false,"published_at":"2026-07-27T23:16:42.33+00:00","url":"https://junglewise.ai/threats/cve-2026-65443-wp-media-backwpup-unauthenticated-xss"},{"cve":"CVE-2026-49045","cvss":4.3,"slug":"cve-2026-49045-wp-media-adminimize-missing-authorization-in-access-control","title":"WP Media Adminimize missing authorization in access control levels","severity":"medium","exploited":false,"published_at":"2026-05-27T15:16:32.95+00:00","url":"https://junglewise.ai/threats/cve-2026-49045-wp-media-adminimize-missing-authorization-in-access-control"}],"vendor":{"hub":true,"name":"WP Media","slug":"wp-media","homepage":"https://wp-media.me/","description":"WP Media is a software development company specializing in performance and backup solutions for WordPress.","url":"https://junglewise.ai/threats/vendors/wp-media"},"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-97076","cvss":7.5,"epss":0.0029,"slug":"cve-2026-97076-executable-regular-expression-error-vulnerability-in-wp-media-wp","title":"WP Media WP Rocket code injection in regular expression","severity":"high","exploited":false,"published_at":"2026-10-09T07:17:19.35+00:00","url":"https://junglewise.ai/threats/cve-2026-97076-executable-regular-expression-error-vulnerability-in-wp-media-wp"},{"cve":"CVE-2026-5934","cvss":7.2,"epss":0.0032,"slug":"cve-2026-5934-wp-rocket-stored-cross-site-scripting-in-rocket-beacon-endpoint","title":"WP Rocket stored cross-site scripting in rocket_beacon endpoint","severity":"high","exploited":false,"published_at":"2026-08-28T16:18:19.657+00:00","url":"https://junglewise.ai/threats/cve-2026-5934-wp-rocket-stored-cross-site-scripting-in-rocket-beacon-endpoint"},{"cve":"CVE-2026-32569","cvss":7.1,"slug":"cve-2026-32569-unauthenticated-cross-site-scripting-xss-in-wp-media-folder-6-2-2","title":"WP Media folder cross-site scripting (XSS)","severity":"high","exploited":false,"published_at":"2026-10-06T09:17:42.397+00:00","url":"https://junglewise.ai/threats/cve-2026-32569-unauthenticated-cross-site-scripting-xss-in-wp-media-folder-6-2-2"},{"cve":"CVE-2026-65443","cvss":7.1,"slug":"cve-2026-65443-wp-media-backwpup-unauthenticated-xss","title":"WP Media BackWPup unauthenticated XSS","severity":"high","exploited":false,"published_at":"2026-07-27T23:16:42.33+00:00","url":"https://junglewise.ai/threats/cve-2026-65443-wp-media-backwpup-unauthenticated-xss"},{"cve":"CVE-2026-97075","cvss":6.5,"epss":0.0016,"slug":"cve-2026-97075-missing-authorization-vulnerability-in-wp-media-wp-rocket-wp","title":"WP Media WP Rocket broken access control","severity":"medium","exploited":false,"published_at":"2026-10-09T08:16:55.683+00:00","url":"https://junglewise.ai/threats/cve-2026-97075-missing-authorization-vulnerability-in-wp-media-wp-rocket-wp"},{"cve":"CVE-2026-111464","cvss":5.9,"slug":"cve-2026-111464-the-wp-fastest-cache-plugin-for-wordpress-is-vulnerable-to","title":"WP Fastest Cache sensitive information exposure in caching","severity":"medium","exploited":false,"published_at":"2026-11-03T03:16:42.977+00:00","url":"https://junglewise.ai/threats/cve-2026-111464-the-wp-fastest-cache-plugin-for-wordpress-is-vulnerable-to"},{"cve":"CVE-2026-49045","cvss":4.3,"slug":"cve-2026-49045-wp-media-adminimize-missing-authorization-in-access-control","title":"WP Media Adminimize missing authorization in access control levels","severity":"medium","exploited":false,"published_at":"2026-05-27T15:16:32.95+00:00","url":"https://junglewise.ai/threats/cve-2026-49045-wp-media-adminimize-missing-authorization-in-access-control"},{"cve":"CVE-2026-114431","slug":"cve-2026-114431-the-enable-media-replace-wordpress-plugin-before-4-2-3-does-not","title":"Enable Media Replace stored XSS via SVG upload bypass","severity":"info","exploited":false,"published_at":"2026-11-04T06:17:00.867+00:00","url":"https://junglewise.ai/threats/cve-2026-114431-the-enable-media-replace-wordpress-plugin-before-4-2-3-does-not"}],"generated_at":"2026-11-12T03:07:00.164048+00:00","technologies":[{"name":"WP Media WP Rocket","slug":"wp-rocket","vulnerabilities":3,"url":"https://junglewise.ai/threats/technologies/wp-rocket"}]}