Vendor

    Wp Media

    17 known vulnerabilities in products by Wp Media, 0 of them actively exploited (CISA KEV).

    Key figures

    17

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    1

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Wp Media
    HighCVE-2026-6227

    BackWPup <= 5.6.6 - Authenticated (Administrator+) Local File Inclusion via 'block_name' Parameter

    		7.2
    HighCVE-2023-5504

    BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal

    also in 1 other product

    		8.7
    MediumCVE-2023-5505

    BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversal

    also in 1 other product

    		6.8
    HighCVE-2026-97076

    WordPress WP Rocket plugin < 3.23.5 - Denial of Service Attack vulnerability

    		7.5
    HighCVE-2026-100196

    LazyLoad Plugin <= 2.4.0 - Unauthenticated Stored Cross-Site Scripting via Comment Content

    		7.2
    HighCVE-2026-5934

    WP Rocket: Cross-site Scripting

    		7.2
    MediumCVE-2026-97075

    WordPress WP Rocket plugin < 3.23.5 - Broken Access Control vulnerability

    		6.5
    HighCVE-2025-15041

    WP Media BackWPup: Missing Authorization

    		7.2
    MediumCVE-2026-105884

    WordPress Rocket Lazy Load plugin <= 2.4.0 - Cross Site Scripting (XSS) vulnerability

    		6.5
    HighCVE-2026-65443

    WordPress BackWPup plugin <= 5.7.4 - Cross Site Scripting (XSS) vulnerability

    		7.1
    MediumCVE-2026-125834

    WordPress Imagify plugin <= 2.3.4 - Broken Access Control vulnerability

    		4.3
    MediumCVE-2026-28044

    WordPress WP Rocket plugin <= 3.19.4 - Cross Site Scripting (XSS) vulnerability

    		5.9
    MediumCVE-2025-10579

    BackWPup <= 5.5.0 - Missing Authorization to Sensitive Information Exposure

    		5.3
    MediumCVE-2026-49045

    WordPress Adminimize plugin <= 1.11.11 - Broken Access Control vulnerability

    		4.3
    CriticalCVE-2024-38759

    WordPress Search & Replace plugin <= 3.2.2 - Deserialization of untrusted data vulnerability

    		5.4
    HighCVE-2024-4145

    Search & Replace < 3.2.2 - Admin+ SQL injection

    		3.8
    LowCVE-2023-5775

    BackWPup <= 4.0.2 - Plaintext Storage of Backup Destination Password

    also in 1 other product

    		2.2

    Products

    Products by Wp Media
    Backwpup – Wordpress Backup & Restore Plugin60
    Wp Rocket40