Wp Media vulnerabilities

Products

• Backwpup – Wordpress Backup & Restore Plugin 6

Newest

• wp media lazyload plugin – lazy load images, videos, and iframes LazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content CVE-2026-100196 7.2 HighOctober 10, 2026
• wp media backwpup – wordpress backup & restore plugin BackWPup <= 5.6.6 - Authenticated (Administrator+) Local File Inclusion via 'block_name' Parameter CVE-2026-6227 Public exploit 7.2 HighApril 14, 2026
• wp media backwpup – wordpress backup & restore plugin BackWPup <= 5.6.2 - Authenticated (BackWPup Helper+) Privilege Escalation via Arbitrary Options Update CVE-2025-15041 7.2 HighFebruary 19, 2026
• wp media backwpup – wordpress backup & restore plugin BackWPup <= 5.5.0 - Missing Authorization to Sensitive Information Exposure CVE-2025-10579 5.3 MediumOctober 25, 2025
• inpsyde backwpup, wp media backwpup – wordpress backup & restore plugin +1 more BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal CVE-2023-5505 6.8 MediumAugust 17, 2024
• inpsyde backwpup, wp media backwpup – wordpress backup & restore plugin +1 more BackWPup <= 4.0.2 - Plaintext Storage of Backup Destination Password CVE-2023-5775 2.2 LowFebruary 24, 2024
• inpsyde backwpup, wp media backwpup – wordpress backup & restore plugin +1 more BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal CVE-2023-5504 8.7 HighJanuary 11, 2024